Google Chrome EUVD-2026-93684

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (via a separate vulnerability), then to use social engineering to induce the victim to interact with a crafted HTML page/fullscreen prompt in the FullScreen component. Limiting factors: this is a chain component (not standalone), it needs mandatory user interaction (UI:R), high attack complexity (AC:H) due to the pre-required renderer compromise, and affects Chrome versions prior to 155.0.8059.39. It is not exploitable against a default, fully-patched browser without the prerequisite renderer foothold.

This is a genuinely high-CVSS (8.3) issue whose real-world standalone risk is moderate and heavily conditional. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reports network vector with no privileges, but this directly conflicts with the description, which requires the attacker to have ALREADY compromised the renderer process - a significant prerequisite the PR:N metric does not capture (it is modeled instead via AC:H and UI:R). In practice this is a sandbox-escape-class chain component, not an independently remotely-exploitable flaw. Google's own Chromium rating is Medium, versus NVD-style CVSS 8.3 High, reflecting exactly this gap between theoretical scope/impact and realistic exploitability. The exploitation signals are weak and mutually consistent: EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data, so there is no public exploit identified at time of analysis. Given the ubiquity of Chrome, any practical exploit would be impactful, but the requirement for a pre-existing renderer compromise plus social engineering keeps this firmly in the 'patch on normal Chrome cadence' tier rather than emergency-response. Net: not an active-exploitation priority today, but worth prompt patching because Chrome is everywhere and this strengthens full exploit chains.

An attacker who has already exploited a separate bug to compromise Chrome's renderer process lures the victim to a crafted HTML page and uses social engineering to get the user to interact with a fullscreen prompt. Because of the missing authorization check in the FullScreen component, the attacker bypasses system access restrictions and extends impact beyond the browser sandbox. No public proof-of-concept was identified in the provided data.