Google Chrome EUVD-2026-93685

Exploitation REQUIRES the attacker to have already compromised the Chrome renderer process (an explicit precondition in the description), plus user interaction in the form of the victim loading a crafted HTML page (UI:R). The confused deputy is specifically in the 'Contextual Tasks' feature of Chrome, and the goal is to bypass web origin policy to reach a privileged page. Key LIMITING factors: this is not a standalone remote exploit - it must be chained after a separate renderer-code-execution bug; it affects Chrome builds prior to 155.0.8059.39 and is fixed by updating; impact is integrity-only (no data disclosure or availability loss). These constraints make real-world standalone exploitation impractical absent an existing sandbox foothold.

This is a genuinely moderate, not critical, issue and the signals are largely consistent in pointing to low real-world urgency. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) scores it as network-reachable with no privileges, but this is MISLEADING when read against the description: the flaw is only reachable by 'a remote attacker who had compromised the renderer process,' meaning a renderer-compromise primitive (a separate vulnerability) is a hard prerequisite - the PR:N metric reflects Chrome's sandbox threat model rather than true unauthenticated reach. Chromium itself rated the severity only Medium, consistent with this being a sandbox-escape/origin-bypass building block rather than a standalone RCE. Exploitation signals reinforce low priority: EPSS is 0.19% (8th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, there is no KEV listing and no public exploit identified at time of analysis. The impact is integrity-only (C:N/I:H/A:N) - a web-origin-policy bypass into a privileged page - not data theft or denial of service. Net: a real defense-in-depth bug worth patching on the normal Chrome auto-update cadence, but not an emergency; the apparent 'network/no-auth' profile is tempered by the renderer-compromise precondition.

An attacker who already holds a renderer-process compromise (via a separate bug) lures a victim to a crafted HTML page; the confused-deputy flaw in Contextual Tasks causes a privileged Chrome page to act on the attacker's behalf, letting the attacker-controlled origin bypass the web origin policy and reach a privileged context. No public exploit is identified at time of analysis, and the chain depends on first obtaining renderer code execution, so realistic use is as a sandbox-escape link rather than a drive-by.