Google Chrome EUVD-2026-89374

Requires local access to a Windows host running Chrome prior to 154.0.8037.92: the attacker must be able to execute a local program that interacts with Chrome's Mojo IPC to escape the sandbox. Limiting factors are that the vector is local (AV:L) rather than remote, some user interaction is involved (UI:R), and the flaw is Windows-specific - non-Windows Chrome builds are unaffected. Practically this is a second-stage exploit: the attacker typically needs an existing sandboxed foothold (e.g., a compromised renderer) to convert into a full sandbox escape.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.6) describes a local-vector, low-complexity, unauthenticated flaw requiring user interaction that produces a scope change with high confidentiality, integrity, and availability impact - the classic signature of a sandbox escape. This is improper privilege management (CWE-269) in Chrome's Mojo IPC layer on Windows: the local attacker leverages a malicious local program to break out of the renderer/browser sandbox, hence S:C and full CIA impact. The realistic priority is HIGH because Chrome is ubiquitous and Chromium rated the severity High, but two mitigating signals temper it: the attack vector is LOCAL (AV:L), not network, so an attacker must already run code on the host, and UI:R means some user action is involved. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is unproven; this is a patch-now-on-cycle browser update rather than an actively-exploited emergency. Note AV:L combined with 'execute arbitrary code outside the sandbox via a local program' is internally consistent (sandbox escapes are inherently local-chained), so no vector/description conflict here - unlike a hypothetical network-vector claim.

An attacker who can run an unprivileged local program on a Windows host (e.g., via a prior drive-by compromise of a sandboxed renderer or a low-privilege malware foothold) abuses the improper privilege management in Chrome's Mojo IPC to send crafted messages that escape the browser sandbox and execute code with the browser's full privileges. This chains a sandboxed initial foothold into a full-context compromise. No public proof-of-concept was identified at time of analysis.