Google Chrome EUVD-2026-93596

Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a separate prerequisite bug), then delivers a crafted HTML page to trigger the missing authorization in the Actor component and escape the sandbox. Limiting factors: user interaction is required (UI:R - the victim must load attacker content), attack complexity is high (AC:H), and the renderer-compromise precondition means this is only useful as part of an exploit chain, not as an initial access vector. Affected deployments are Chrome desktop versions prior to 155.0.8059.39; patched builds are not exploitable.

Signals conflict sharply and must be weighed carefully. The input CVSS of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C with C:H/I:H/A:H) looks severe because of the scope change (sandbox escape) and triple-high impact, yet Google's own Chromium security team rated this 'Low'. That gap is explained by the exploitation precondition stated in the description: the attacker must have ALREADY compromised the renderer process, so this is a sandbox-escape link in a multi-stage exploit chain, not a standalone remote code execution. CVSS encodes that only as AC:H (and arguably should lower the effective privilege), which is why the raw score overstates real-world standalone risk. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code was supplied, and it was reported internally by the Chrome team (typical of proactive, pre-disclosure fixes) rather than discovered through observed attacks. Net assessment: patch-worthy because Chrome is ubiquitous and sandbox escapes are valuable to chain-builders, but this is a 'high-CVSS, lower-real-urgency' item absent evidence of an accompanying renderer exploit - prioritize normal Chrome auto-update cadence rather than emergency response. Note explicitly: CVSS PR:N implies unauthenticated, but the description's 'compromised the renderer process' prerequisite means a working attack first needs a separate renderer bug - verify chaining context before treating as directly exploitable.

An attacker first exploits a separate renderer-process vulnerability (e.g., via a malicious or compromised website the victim visits) to gain code execution inside Chrome's sandbox. They then serve a crafted HTML page that triggers this missing-authorization flaw in the Actor component to break out of the renderer sandbox and run arbitrary code on the host. No public exploit code was provided in the intelligence, and high attack complexity plus the required prior renderer compromise make standalone exploitation impractical.