Google Chrome EUVD-2026-91713

Exploitation requires the victim to load attacker-controlled HTML/SVG content in Chrome (UI:R - user interaction via navigating to or rendering a crafted page); no authentication or special privileges are needed (PR:N). The primary limiting factor is that resulting arbitrary code execution is confined to the renderer sandbox, so meaningful host-level compromise requires chaining with an additional sandbox-escape vulnerability. Affected: Google Chrome versions prior to 154.0.8037.97; updating to 154.0.8037.97 or later remediates it. No non-default configuration is required - standard browsing of a malicious page is sufficient.

This is a genuine high-priority patching target, though not a drop-everything emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) shows network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page - a very low bar given normal browsing behavior. Chromium rates the severity High. The key mitigating signal is in the description itself: code execution occurs INSIDE the renderer sandbox (confirmed by both the description and S:U/unchanged scope), so a successful exploit does not by itself yield full host compromise and would typically need to be chained with a separate sandbox-escape to be fully weaponized. No EPSS score was provided, this CVE is NOT listed in CISA KEV, and no public POC is indicated, so there is no evidence of active or widespread exploitation at this time - the priority rests on the inherent exploitability of UAF renderer bugs and Chrome's enormous attack surface rather than on observed in-the-wild activity. Note the absence of EPSS/KEV/POC is a data gap, not confirmation of safety; browser UAF flaws are historically attractive to attackers and frequently become exploited after patch disclosure.

An attacker hosts a malicious web page (or injects crafted content into a compromised/ad-served page) that manipulates SVG DOM objects to trigger a use-after-free in Chrome's SVG handling. When a victim simply visits the page, the freed-then-reused memory lets the attacker corrupt renderer state and execute arbitrary code within the browser's sandboxed renderer process. No public exploit code is identified at time of analysis, and full host compromise would require chaining this with a separate sandbox escape.