Google Chrome EUVD-2026-89402

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process before this bug can be used - it is a chained, second-stage vulnerability, not an initial access vector. It further requires user interaction (UI:R, e.g., visiting/loading attacker content) and delivery of a crafted HTML page, and affects Chrome versions prior to 154.0.8037.92. The impact is limited to bypassing web-origin (Site Isolation) policy for an integrity effect (I:H) with no direct confidentiality or availability impact. The prior-renderer-compromise requirement is the dominant limiting factor and substantially reduces real-world risk versus the CVSS PR:N encoding.

This is a genuinely lower-tier issue despite a moderate 6.5 CVSS. The vendor itself rated it 'Chromium security severity: Low', and the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a single-impact bug: integrity-only (I:H) with no confidentiality or availability effect. The critical caveat is that the description explicitly requires 'a remote attacker who had compromised the renderer process' - i.e., this is a second-stage bug useful only after an attacker already controls a sandboxed renderer, so it functions as a link in an exploit chain (a partial sandbox/origin-policy weakening) rather than a standalone entry point. Note the conflict: the CVSS encodes PR:N (unauthenticated), but the description imposes a substantial prerequisite (prior renderer compromise) that PR:N does not capture - this is a known Chrome scoring convention where the renderer-compromise precondition is treated as out-of-scope chaining rather than a privilege. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is 'no public exploit identified at time of analysis.' Overall: real but low priority - it requires an existing renderer compromise and only weakens origin isolation rather than granting code execution or data theft directly.

An attacker first compromises a Chrome renderer process (e.g., via a separate memory-corruption bug or a malicious site the victim visited after clicking through - UI:R), then serves a crafted HTML page that exploits the SiteIsolation authorization flaw to bypass web-origin policy from within the already-controlled renderer. This lets the attacker access or act on content belonging to another web origin that Site Isolation should have kept separate, deepening an existing foothold. No public exploit code was identified at time of analysis.