Google Chrome EUVD-2026-89241

Exploitation requires a victim using Google Chrome earlier than 154.0.8037.57 to load attacker-controlled web content (UI:R) - e.g., visiting a malicious site or rendering a malicious ad/iframe - which triggers the use-after-free in the renderer. No authentication or prior privileges are needed (PR:N) and no special non-default configuration is indicated. Limiting factors: user interaction is mandatory (the victim must open the page), the affected version window is bounded (fixed in 154.0.8037.57, patch available from vendor), and because scope is Unchanged the impact is confined to the sandboxed renderer, so full-system compromise realistically requires chaining an additional sandbox-escape vulnerability.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a network-reachable, low-complexity, unauthenticated use-after-free requiring only that a victim visit a malicious page (UI:R). No EPSS score is provided, this CVE is NOT in the CISA KEV catalog, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis' - this is prioritization by severity and product ubiquity, not by observed activity. The three impact metrics all being High (C:H/I:H/A:H) is consistent with a renderer memory-corruption bug of RCE-class potential; because scope is Unchanged (S:U), impact is contained to the sandboxed renderer process and full system compromise requires chaining a separate sandbox-escape, which tempers real-world severity below the raw score. Note a labeling conflict: the input Tags include 'Information Disclosure', but the vector shows I:H/A:H (not a confidentiality-only leak), so that tag is mislabeled - the 'Use After Free' and 'Memory Corruption' tags are accurate. This is a genuine patch-now item for any Chrome fleet given the browser's footprint, but it is not evidence of active in-the-wild targeting.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) that exercises the vulnerable Chrome code path to trigger a use-after-free in the renderer. When a victim simply visits the page (UI:R), the freed-then-reused object is groomed to gain control of freed memory, yielding renderer-process code execution that would typically be chained with a sandbox escape for full compromise. No public exploit code has been identified at the time of analysis.