Google Chrome EUVD-2026-89393

Exploitation requires that the attacker has ALREADY compromised Chrome's sandboxed renderer process - this is a sandbox-escape/second-stage bug, not a standalone entry point. Given that foothold, the attacker must serve a crafted HTML page and the victim must render it (UI:R) in a Chrome version prior to 154.0.8037.92, whereupon the use-after-free in the PictureInPicture component is triggered to escape the sandbox. The limiting factors are significant: the required prior renderer compromise (reflected as AC:H) means this cannot be exploited in isolation and is realistically only usable as the second link in an exploit chain; user interaction (loading the page) is also required. It affects default configurations - no special Chrome feature toggle is needed beyond normal PictureInPicture functionality.

This is a genuine high-priority vulnerability, though its exploitation is gated behind a precondition that meaningfully reduces standalone risk. The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) with a scope change (S:C) reflects the description's explicit claim of code execution 'outside the sandbox' - a full sandbox escape, which is the most severe class of browser bug. AC:H is consistent with the requirement that the attacker must ALREADY have compromised the renderer process, and UI:R reflects the need for a victim to load a crafted page. However, exploitation signals are all quiet: SSVC reports Exploitation:none and Automatable:no (offset by Technical Impact:total), there is no EPSS score, no CISA KEV listing, and no public POC identified. The Chromium team rates the underlying severity 'High.' In practice this is a second-stage/chained bug: it is not directly weaponizable on its own because it presumes a prior renderer compromise (typically via a separate renderer RCE such as one of the many V8/type-confusion/UAF bugs patched in the same September 2026 stable batch). The realistic conclusion: high priority to patch because of the sandbox-escape impact and the ubiquity of Chrome, but it is not an imminent mass-exploitation threat on its own - the 'total' technical impact is what earns it urgency, not current exploitation activity.

An attacker who has already gained code execution in Chrome's sandboxed renderer process (via a separate, chained renderer exploit) lures or redirects the victim to a crafted HTML page that triggers the use-after-free in the PictureInPicture component. By reclaiming the freed object with attacker-controlled data, the attacker escalates from the constrained renderer into the higher-privileged browser process, executing arbitrary code outside the sandbox. No public exploit code has been identified at time of analysis, and SSVC reports no known exploitation.