Google Chrome EUVD-2026-89386

Requires user interaction (UI:R): the victim must open or navigate to an attacker-crafted HTML page in a vulnerable Chrome build prior to 154.0.8037.92. No authentication or special Chrome configuration is required - the Passwords component is a core, always-present feature, so default installations are affected. The primary limiting factor is that exploitation is not automatable per SSVC and depends on luring the victim to malicious content; the bug also achieves full impact only by chaining the UAF into a sandbox escape, which is non-trivial to develop.

This is a genuine high-priority vulnerability. The CVSS 9.6 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is corroborated by the description: a remote, unauthenticated attacker triggers a use-after-free (CWE-416) in Chrome's Passwords component that executes arbitrary code OUTSIDE the sandbox - the scope change (S:C) and full CIA impact are justified because sandbox escape breaks Chrome's security boundary. Signals partially conflict: SSVC lists Exploitation:none and Automatable:no, and there is no EPSS score, no CISA KEV listing, and no public POC identified, so despite the near-critical 9.6 there is no evidence of active exploitation at time of analysis. Technical Impact is rated total, consistent with RCE. The realistic risk driver is Chrome's ubiquity plus the sandbox-escape nature (rare and valuable), not current exploitation activity - patch urgency is high on prevalence grounds even though weaponization is not yet confirmed. Note UI:R means a victim must visit a malicious page, which modestly limits drive-by mass exploitation versus a zero-click bug.

An attacker crafts a malicious HTML page and lures a victim to visit it (via link, ad, or compromised site). The page triggers a use-after-free in Chrome's Passwords subsystem, and because the flaw permits code execution outside the renderer sandbox, the attacker achieves arbitrary code execution on the host. No public exploit code has been identified at time of analysis.