Google Chrome EUVD-2026-93639

Exploitation requires the attacker to FIRST have compromised Chrome's sandboxed renderer process (via a separate, unrelated vulnerability) - this flaw alone is not independently exploitable and functions only as a cross-origin data-leak stage in a larger chain. It additionally requires the victim to load attacker-controlled crafted HTML (UI:R / user interaction) and carries high attack complexity (AC:H), reflecting non-deterministic timing to use the already-released resource. These factors - mandatory prior renderer compromise, required user interaction, and high complexity - substantially limit realistic exploitation. Affects Google Chrome versions prior to 155.0.8059.39; fixed by updating to that release or later.

This is a low-priority, low-real-risk issue despite being network-reachable. The CVSS 3.1 base score is 3.1 (Low) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - network vector but high attack complexity, user interaction required, and only partial confidentiality impact (no integrity or availability loss). Critically, the CVSS vector encodes PR:N (no privileges), but the description states the attacker must have ALREADY compromised the renderer process - this is a significant conflict: the flaw is not independently exploitable by an unauthenticated remote attacker and only has value as a secondary stage in an exploit chain that first achieves renderer code execution. CISA SSVC reinforces the low priority: Exploitation=none, Automatable=no, Technical Impact=partial. There is no KEV listing and no POC referenced, so there is no public exploit identified at time of analysis. EPSS was not provided. All signals (low CVSS, high complexity, SSVC none/no/partial, chained precondition, vendor-assigned 'Low' severity) are consistent and point to a genuinely low-risk, defense-in-depth bug rather than an urgent threat - routine patching via normal Chrome auto-update is sufficient.

An attacker who has already exploited a separate vulnerability to gain code execution in Chrome's sandboxed renderer process lures or directs the victim to a crafted HTML page, which triggers use of a released resource in Chrome Core to read data belonging to a different origin, bypassing the same-origin policy. No public exploit code has been identified, and the high attack complexity plus the requirement of a pre-compromised renderer make opportunistic exploitation unlikely.