Google Chrome EUVD-2026-93651

Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a prior, separate vulnerability or foothold) - this is the primary gating condition, stated explicitly in the description. Beyond that, the victim must load attacker-controlled content: a crafted HTML page is delivered and user interaction is required (UI:R), and the high attack complexity (AC:H) indicates the use-after-free on the released Session resource is not reliably triggered. The realized impact is limited to spoofing UI elements, not code execution or data exfiltration. These factors - mandatory pre-compromise of the renderer, user interaction, and high complexity - substantially limit real-world exploitability despite the network attack vector. Affected: Google Chrome before 155.0.8059.39 (fixed in 155.0.8059.39).

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. CVSS 3.1 base is 4.2 (Low) with AV:N/AC:H/PR:N/UI:R, and crucially the description adds a prerequisite the CVSS vector does not capture: the attacker 'had compromised the renderer process' already. That is a significant precondition - this is a post-renderer-compromise UI-spoofing primitive, not a standalone remote exploit, so the effective privilege requirement is much higher than the PR:N in the vector suggests (verify the PR:N interpretation: Chrome's threat model treats renderer compromise as a baseline, which is why PR:N was used, but operationally a prior foothold is required). SSVC reinforces low priority: Exploitation=none, Automatable=no, Technical Impact=partial. No EPSS score was provided, there is no CISA KEV listing, and no public POC is indicated. Chromium itself rated this Low severity. The impact is limited to spoofing UI elements (chrome/browser UI deception) rather than code execution or data theft. Net: a real but low-severity defense-in-depth bug relevant mainly as one link in a larger renderer-compromise chain, not an urgent standalone threat.

An attacker who has already exploited a separate bug to gain control of Chrome's renderer process uses this use-after-free on a released Session resource to manipulate what the browser displays, spoofing UI elements via a crafted HTML page to deceive the user (e.g., faking security indicators or dialogs). No public exploit code is identified, and the high attack complexity plus the requirement for a pre-compromised renderer and user interaction make opportunistic exploitation unlikely.