Google Chrome EUVD-2026-93619

Exploitation requires the victim to open an attacker-controlled or compromised HTML page in Chrome that contains crafted media content processed by the vulnerable Media component - the CVSS UI:R confirms mandatory user interaction (visiting/loading the page), which is the primary limiting factor. No authentication or elevated privileges are needed (PR:N). The attack targets Chrome versions prior to 155.0.8059.39 on default configurations; the description's qualifier 'potentially execute arbitrary code' plus Google's 'Low' Chromium severity indicate the sandbox escape is not reliably achievable and may depend on specific memory conditions or chaining with other primitives, substantially limiting practical exploitation.

The input presents a stark conflict between signals that must be resolved before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) describes a remotely reachable, low-complexity, unauthenticated flaw that only requires a user to open a page, with a scope change consistent with the description's claim of code execution 'outside the sandbox' - on paper a top-tier browser RCE. However, Google's own Chromium security rating is explicitly 'Low', which directly contradicts the 9.6 Critical CVSS and is the single most important discrepancy here: a genuine reliable sandbox escape would normally be rated Critical/High by Chromium, so the 'Low' rating suggests the real-world exploitability is far more constrained than the CVSS implies (e.g. the overflow may only 'potentially' lead to escape under hard-to-reach conditions, as the word 'potentially' in the description hints). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the finding was reported internally by Google's Chrome team rather than observed in attacks. Net assessment: treat this as a standard 'patch promptly in the normal Chrome auto-update cycle' browser vulnerability rather than an emergency. The CVSS-vs-Chromium-severity conflict should be resolved in favor of the vendor's 'Low' for urgency purposes, while still patching because the theoretical impact (sandbox escape) is high. This is a high-nominal-CVSS but likely low-real-risk issue absent exploitation signals.

An attacker hosts or compromises a web page containing malformed media content that triggers an integer overflow in Chrome's Media component when the victim browses to it. If the overflow is successfully leveraged, it could corrupt memory in a way that escapes the renderer sandbox and runs attacker code on the victim's machine. No public exploit code was identified, and Google rates the practical severity as Low, so reliable weaponization is likely difficult.