Google Chrome EUVD-2026-93674

Exploitation requires the victim to actively load attacker-controlled web content in a vulnerable Chrome build prior to 155.0.8059.39 - a crafted HTML page that drives the specific garbage-collection code path to trigger the use-after-free (UI:R confirms required user interaction, i.e., visiting/rendering the page). No authentication or elevated privileges are needed (PR:N), and default Chrome configurations are affected since the garbage collector is core functionality, not an optional feature. The principal limiting factors are: (1) mandatory user interaction to open the malicious page, (2) resulting code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so a chained sandbox-escape vulnerability is required for OS-level compromise, and (3) Chrome's automatic update mechanism rapidly reduces the vulnerable population once the stable channel update is applied.

Signals are mixed and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a classic drive-by profile that scores high. However, two signals temper this: the description explicitly states code execution occurs 'inside the sandbox' (consistent with S:U, no scope change), meaning a separate sandbox-escape bug would be needed for full host compromise, and Google's own Chromium severity rating is only 'Medium,' which conflicts with the 8.8 base score. The CISA SSVC framework reinforces lower urgency: Exploitation='none' (not observed), Automatable='no,' though Technical Impact='total.' There is no CISA KEV listing and no public exploit identified at time of analysis, so this is no public exploit identified at time of analysis. EPSS exploitation probability was NOT provided in the input and cannot be factored in - this is a notable data gap. Net assessment: a genuinely patch-worthy memory-corruption bug in ubiquitous software, but current evidence points to it being a high-CVSS issue without confirmed real-world exploitation rather than an urgent actively-exploited threat; prioritize via normal Chrome auto-update cadence.

An attacker hosts or compromises a web page containing JavaScript/HTML that manipulates Chrome's garbage collection to trigger a use-after-free condition. A victim running a vulnerable Chrome build (prior to 155.0.8059.39) simply visits the page, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided data, and full host compromise would additionally require a sandbox-escape primitive.