Google Chrome EUVD-2026-93654

Exploitation requires the attacker to get a victim to install a crafted, attacker-controlled Chrome extension (CVSS UI:R), typically via social engineering as the description states explicitly. It is NOT remote-unauthenticated against a default configuration: the user must be deceived into installing the malicious extension, which is the primary limiting factor and the reason the vendor rated it 'Low' despite total technical impact. Affected deployments are Chrome desktop versions prior to 155.0.8059.39; updating to that version or later removes the condition. Enterprises that restrict extension installation via policy (allowlisting) substantially reduce exposure.

Signals conflict sharply here. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6 Critical, driven by network vector, no privileges, a scope change (sandbox escape) and total CIA impact. However, the vendor's own Chromium severity rating is explicitly 'Low', and the CISA SSVC decision framework reports Exploitation: none and Automatable: no (Technical Impact: total). The description itself constrains the attack: it requires social engineering AND a crafted Chrome extension to escape the sandbox - a meaningful real-world barrier that the raw 9.6 does not convey. No EPSS score was provided and KEV status is NO, so there is no evidence of widespread or active exploitation. The most likely reading is that this is a high-CVSS-but-moderate-real-risk issue: the theoretical impact (code execution outside the sandbox) is total, but the practical path depends on convincing a user to install an attacker-controlled extension, which is why the vendor rated it Low and SSVC marks it non-automatable. Note the discrepancy explicitly: CVSS 9.6 Critical vs. vendor severity Low and SSVC Exploitation:none - treat the 9.6 as worst-case ceiling, not expected likelihood. Standard priority: patch via the already-available Chrome update, but not an emergency relative to unauthenticated zero-click flaws.

An attacker publishes or sideloads a malicious Chrome extension and uses social engineering (phishing, fake utility, deceptive listing) to persuade a victim to install it. The extension triggers the use-after-free in Chrome's Network component to corrupt memory and execute arbitrary code outside the browser sandbox on the victim's host. No public exploit identified at time of analysis, and no active exploitation is reported (KEV: NO, SSVC Exploitation: none).