Google Chrome EUVD-2026-89401

Exploitation requires the attacker to have ALREADY compromised the renderer process of Chrome/WebView on Android (prior to 154.0.8037.92) - this is the primary limiting prerequisite and typically demands a separate renderer-level exploit. Given that foothold, the attacker delivers a crafted HTML page that triggers the incorrect authorization in WebView to run code outside the sandbox. Limiting factors: user interaction is required (UI:R - victim must load attacker content), attack complexity is high (AC:H), the target is specifically the Android WebView platform, and unpatched versions below 154.0.8037.92 are needed. No additional authentication is required (PR:N), but the renderer-compromise dependency makes standalone exploitation infeasible.

This is a second-stage sandbox-escape flaw, not a standalone remote-compromise bug: the description explicitly requires an attacker who has ALREADY compromised the renderer process, so it functions as the escape link in an exploit chain rather than an initial-access vector. The NVD-style vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.5 and reflects total technical impact (arbitrary code execution outside the sandbox) tempered by high attack complexity and required user interaction. Signals conflict on severity: NVD-equivalent scoring is High (7.5) while Chromium itself rates this security severity Low, indicating Google views the practical risk as limited (renderer must already be owned). SSVC reinforces the lower urgency - Exploitation: none, Automatable: no, Technical Impact: total - meaning maximal damage IF reached, but no observed exploitation and no automatable mass-exploitation path. No EPSS score, no CISA KEV listing, and no public POC are present in the input. Net: genuine full-impact potential but gated behind a prior renderer exploit, no evidence of real-world use - a patch-in-normal-cycle item, not an emergency, despite the High numeric score.

An attacker first exploits a separate renderer-process vulnerability (e.g., a V8 or Blink bug) via a malicious web page loaded in Chrome/WebView on Android, gaining code execution inside the sandboxed renderer. They then serve a crafted HTML page that abuses the incorrect authorization (CWE-863) in WebView to break out of the renderer sandbox and execute arbitrary code with the browser's higher privileges. No public exploit code is identified at time of analysis, and the high attack complexity plus the prerequisite renderer compromise make this a chained, targeted technique rather than opportunistic.