Google Chrome EUVD-2026-89250

Exploitation requires the victim to run a vulnerable Chrome desktop build (earlier than 154.0.8037.57) and to visit or interact with attacker-controlled web content (UI:R). No authentication is needed (PR:N), but the high attack complexity (AC:H) means the attacker must satisfy additional preconditions - likely precise memory-state/heap grooming or timing - making reliable exploitation harder than a default one-shot drive-by. The scope change (S:C) implies crossing Chrome's renderer sandbox boundary. Limiting factors: mandatory user interaction, AC:H reliability barrier, and the fix already being shipped in the stable channel reduce realistic exposure for auto-updated installs.

This is a genuinely high-priority issue driven primarily by product prevalence rather than exploitation certainty. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) describes a network-reachable, unauthenticated flaw affecting full CIA triad with a scope change - consistent with a renderer/sandbox boundary crossing typical of browser memory-safety bugs. Two signals temper the raw score: AC:H indicates non-trivial preconditions (heap grooming, precise timing, or specific object states) rather than a one-shot trigger, and UI:R requires the victim to visit or interact with an attacker-controlled page. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis - this is NOT confirmed active exploitation. The CWE-20 (Improper Input Validation) classification is broad; combined with I:H/A:H it points to memory corruption or a sandbox-escape-class defect, not the mere information disclosure implied by the input Tag. DATA CONFLICT: the input Tag says 'Information Disclosure' but the vector shows I:H and A:H, so it is mislabeled. Net: a patch-now item because Chrome is ubiquitous and the fix is already shipped, but absent KEV/EPSS/POC this is not evidence of widespread in-the-wild abuse.

An attacker hosts or compromises a web page containing content crafted to trigger the input-validation flaw in Chrome's rendering/processing path. When a victim on Chrome earlier than 154.0.8037.57 visits the page, the malformed input drives memory corruption; because scope changes (S:C), successful exploitation can cross the renderer sandbox boundary. No public POC is currently identified, and the AC:H rating implies the attacker needs favorable heap/timing conditions to make the trigger reliable.