Google Chrome EUVD-2026-89385

Requires the victim to open or navigate to an attacker-controlled HTML page in an unpatched Chrome build before 154.0.8037.92 (UI:R / social engineering). No authentication or special browser configuration is needed - it affects default Chrome installations - but exploitation is limited by the need for user interaction and by the difficulty of achieving a reliable use-after-free-to-code-execution sandbox escape. Applies to desktop Chrome per the advisory.

This is a genuine high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) reflects a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (visiting a malicious page), and the S:C scope change is corroborated by the description's explicit 'execute arbitrary code outside the sandbox' - a sandbox escape, which is the most severe class of browser bug. The CWE-416 use-after-free classification and 'Memory Corruption'/'RCE' tags are consistent. Countervailing signals: no EPSS score is provided, there is no CISA KEV listing, and no public exploit code is identified, so despite the 9.6 the observable exploitation evidence is currently absent. Google rates the Chromium severity 'High' rather than 'Critical', consistent with the requirement for social engineering / user interaction. Net: treat as high priority for patching given ubiquity + sandbox-escape RCE, while noting exploitation is not yet confirmed in the wild.

An attacker crafts a malicious HTML page that triggers the use-after-free in Chrome's Views UI component and lures a victim to open it (malvertising, phishing link, or compromised site). Successful exploitation corrupts memory and executes attacker-controlled code outside the browser sandbox on the victim's host. No public exploit code has been identified at time of analysis.