Google Chrome EUVD-2026-89399

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (a prior, separate vulnerability), after which this missing-authorization flaw in CORS handling permits bypassing the web origin policy via a crafted HTML page. Limiting factors: user interaction is required (UI:R - victim must load the attacker's page), the flaw affects only Chrome builds prior to 154.0.8037.92, and it is not independently exploitable without the preceding renderer compromise, which is why SSVC rates it non-automatable with partial technical impact.

This is a Medium-severity Chromium issue with genuinely modest real-world risk despite the 6.5 CVSS. The single most important signal is the description's explicit precondition: exploitation requires an attacker 'who had compromised the renderer process.' This means the bug is a second-stage primitive that only becomes reachable AFTER a separate renderer compromise (e.g. via a prior V8/DOM RCE), not a standalone remote entry point. The CVSS vector (AV:N/AC:L/PR:N/UI:R) does not capture this chaining prerequisite - PR:N understates the real barrier, since the attacker must already control renderer-level code execution before this authorization/CORS bypass matters. All secondary signals agree on low urgency: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit code identified. There is a slight internal tension in the vendor vector itself - a web-origin-policy bypass that lets an attacker read cross-origin data would normally imply confidentiality impact (C:H), yet the vector sets C:N/I:H; the I:H likely reflects the ability to violate origin integrity guarantees rather than exfiltrate data, but this is worth verifying against the Chromium issue tracker (issue 554038924). Net: real but low priority - a defense-in-depth sandbox/origin-isolation weakness, not an independently exploitable network vulnerability.

An attacker first achieves code execution inside Chrome's renderer sandbox through a separate vulnerability, then leverages this CORS authorization gap to make the compromised renderer issue cross-origin requests that bypass the web origin policy, reading or acting on resources it should not be able to reach. A crafted HTML page delivered to the victim is the initial lure requiring user interaction (UI:R). No public exploit code exists and CISA reports no observed exploitation.