Google Chrome EUVD-2026-93610

Exploitation is NOT possible against a default, unmodified browser alone: the attacker must have ALREADY compromised the Chrome renderer process (via a separate vulnerability) before this flaw can be leveraged, and must then deliver a crafted HTML page that abuses WebAudio to bypass system access restrictions. The required prior renderer compromise is the dominant limiting factor, making this a second-stage/sandbox-escape building block rather than a standalone remote attack; affected versions are Chrome prior to 155.0.8059.39.

Signals converge on LOW real-world priority. Chromium itself rated this 'Low' severity, CVSS is 5.4 (medium) with only partial confidentiality/integrity impact (C:L/I:L/A:N), EPSS is 0.18% (7th percentile - very low predicted exploitation), it is NOT in CISA KEV, and SSVC reports Exploitation:none / Automatable:no / Technical Impact:partial. These are all consistent and reinforce low urgency. CONFLICT TO NOTE: the CVSS vector lists PR:N (unauthenticated) and UI:R, yet the description states the attacker must have 'compromised the renderer process' first - a significant prerequisite the base vector does not reflect. This means the flaw is not independently exploitable; it is a second-stage sandbox/system-restriction bypass that must be chained with a separate renderer-compromise bug, which materially lowers standalone risk below what AV:N/PR:N alone would imply. Verify scoring assumptions with the vendor advisory.

An attacker first gains code execution inside Chrome's renderer process via a separate, unrelated vulnerability. They then serve a crafted HTML page that abuses improper input validation in WebAudio to bypass system access restrictions from that already-compromised renderer. No public exploit code was identified at the time of analysis.