Google Chrome EUVD-2026-93655

Exploitation requires the victim to use an unpatched Chrome build prior to 155.0.8059.39 and to load attacker-controlled HTML containing the triggering CSS (UI:R - the user must visit or be redirected to the malicious page); no authentication or special configuration is needed against default Chrome installs. The key limiting factor is sandbox containment: per the description, code execution is confined 'inside the sandbox' (renderer process), so full system compromise realistically requires chaining an additional sandbox-escape vulnerability. This containment, plus the required user interaction, is why the vendor rates the issue 'Low' despite the high CVSS impact metrics.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a page), which on its face looks high priority. However, two signals temper this: Google's own Chromium security severity rating is 'Low,' and the description explicitly states code execution occurs 'inside the sandbox' - i.e., confined to the renderer process rather than full host compromise, which is why the vendor rates it low despite the CVSS numeric. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the provided data, so there is no evidence of active or imminent exploitation. There is a notable tension here: the CVSS 8.8 (C:H/I:H/A:H) overstates real-world impact relative to the vendor's 'Low' rating because a sandboxed renderer-only UAF typically requires chaining with a separate sandbox-escape bug to achieve meaningful system compromise - the CVSS vector does not capture the sandbox containment. Net: a patch-promptly browser bug, but not an emergency relative to its CVSS number; the mitigating sandbox and absence of exploitation signals suggest moderate real-world priority driven mainly by Chrome's enormous install base, not by severity.

An attacker hosts or compromises a web page containing crafted HTML/CSS that triggers the use-after-free in Chrome's CSS engine when rendered. A victim running an unpatched Chrome (prior to 155.0.8059.39) visits the page, and the attacker gains arbitrary code execution within the renderer sandbox; meaningful host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code is identified in the provided data.