Google Chrome EUVD-2026-93624

Exploitation requires a victim using Google Chrome before version 155.0.8059.39 to open or render an attacker-controlled HTML page containing a crafted payload that triggers the V8 type-confusion condition (UI:R - user interaction via visiting the page is mandatory; there is no drive-by without the user loading attacker content). No authentication or special Chrome configuration is required (PR:N), and the affected V8 engine is present in all default Chrome installations. The principal limiting factor is that resulting code execution is confined to the renderer sandbox: achieving host-level compromise additionally requires a separate, chained sandbox-escape vulnerability, which is not provided by this flaw alone. Patched builds (155.0.8059.39 and later) are not exploitable.

Signals conflict and must be weighed carefully. The NVD CVSS 3.1 base score is 8.8 (High) with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N) and total CIA impact, which in isolation suggests a high priority. However, Chromium's own severity rating is 'Low' and the description explicitly states code execution occurs 'inside the sandbox' - meaning this single bug does not, by itself, compromise the host; it would need to be chained with a separate sandbox-escape to achieve full system compromise. This sandbox containment is the key reason the vendor rates it Low despite the high CVSS, and it materially lowers real-world severity versus the raw number. CISA SSVC reinforces a lower urgency: Exploitation 'none' (no observed or public exploitation) and Automatable 'no', though Technical Impact is 'total' (consistent with in-sandbox RCE). There is no CISA KEV listing and no EPSS score supplied in the input, so exploitation-probability data is missing. No public exploit was identified. Net assessment: this is a standard-patch-cadence browser vulnerability - worth deploying the Chrome update promptly given Chrome's ubiquity, but not an emergency 'patch-tonight' item in the absence of a paired sandbox escape, active exploitation, or public POC. Note the CVSS-vs-Chromium severity divergence explicitly and treat it as sandbox-confined RCE rather than direct host compromise.

An attacker hosts or compromises a web page containing malicious JavaScript and lures a Chrome user into visiting it (UI:R - user must open the page). The crafted page triggers a type-confusion flaw in the V8 engine, letting the attacker run arbitrary code within the renderer's sandbox. No public exploit code was identified at the time of analysis, and full host compromise would require chaining this with a separate sandbox-escape vulnerability.