Google Chrome EUVD-2026-93592

Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a prior-stage exploit, not provided by this bug), AND must use social engineering to induce user interaction (UI:R) that bypasses system access restrictions via a crafted HTML page. This is a sandbox/permission-boundary bypass (CWE-862, missing authorization in Permissions), not an initial-access or remote-code-execution flaw. Limiting factors: the dependency on a separate renderer compromise, mandatory user interaction, and the fact that impact is capped at limited confidentiality and integrity effect (C:L/I:L, no availability impact) with no scope change (S:U). Affects Chrome versions prior to 155.0.8059.39 on desktop; patched builds eliminate the condition.

This is a low-priority issue despite its 5.4 (Medium) CVSS score, and multiple signals converge on that conclusion. Google/Chromium itself rated the security severity 'Low'. EPSS is 0.19% (8th percentile), indicating very low predicted exploitation likelihood. CISA SSVC scores Exploitation as 'none', Automatable 'no', and Technical Impact only 'partial' - all consistent with low urgency. It is NOT in CISA KEV and no public exploit code was identified, so exploitation status is 'no public exploit identified at time of analysis'. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) understates real difficulty: the vector shows PR:N (unauthenticated) and AC:L, but the description explicitly requires that the attacker 'had compromised the renderer process' AND 'leveraged social engineering' - two substantial preconditions that a PR:N/AC:L vector does not capture. CONFLICT TO VERIFY: CVSS marks this as low-complexity unauthenticated, yet the description describes it as a post-renderer-compromise sandbox/permission bypass requiring user trickery, which is realistically high-complexity and chained. Treat this as a second-stage escalation primitive (part of an exploit chain), not a standalone remotely weaponizable flaw. Priority is routine patch-cycle, not emergency.

An attacker who has already achieved code execution in Chrome's renderer process (e.g., via a separate renderer bug) serves a crafted HTML page and uses social engineering to coax the user into an action that bypasses system access/permission restrictions, gaining limited additional access beyond the sandbox. No public proof-of-concept exploit was identified, and exploitation depends on an already-compromised renderer plus user interaction (UI:R).