Google Chrome EUVD-2026-93708

Exploitation is strictly conditional on the attacker having ALREADY compromised Chrome's renderer process - this is the explicit precondition in the description and the primary limiting factor. The vulnerable code path is the incorrect reference resolution in Chrome's Passwords component, and successful exploitation results in code execution outside the sandbox via a local program. Limiting factors beyond the renderer-compromise prerequisite: the CVSS vector indicates local attack vector (AV:L, no remote network path) and high attack complexity (AC:H), meaning the attacker needs local presence and must satisfy non-trivial conditions to win the race/reference-resolution flaw. No user interaction is required (UI:N). The exact affected platform (desktop vs. iOS) should be confirmed against the vendor advisory before scoping.

This is a sandbox-escape vulnerability (CWE-706, incorrect reference resolution) in Chrome's Passwords component, rated Medium by Chromium and carrying a CVSS 7.4. The CVSS vector (AV:L/AC:H/PR:N/UI:N) is the dominant signal and it argues against emergency prioritization: exploitation requires LOCAL access (AV:L) and has HIGH attack complexity (AC:H), and the description makes the real gating precondition explicit - the attacker must ALREADY have compromised the renderer process. This is therefore a second-stage/chaining bug, not a standalone remote RCE, despite the high C/I/A impact ratings. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active or at-scale exploitation; exploitation status is 'no public exploit identified at time of analysis.' Note the PR:N rating is somewhat misleading for defenders: although no application-level authentication is needed, the realistic prerequisite (a pre-compromised renderer) is a substantial barrier that the CVSS vector does not fully capture. One data conflict must be flagged: the description states the flaw affects 'Google Chrome on iOS,' yet the only release reference points to a desktop stable-channel update - verify the actually-affected platform(s) with the vendor advisory.

An attacker first gains code execution inside Chrome's renderer process (e.g., via a separate browser exploit or malicious web content), then leverages the incorrect reference resolution in the Passwords component to break out of the renderer sandbox and run arbitrary code via a local program. Because this requires a pre-existing renderer compromise and high attack complexity, it is realistically the second link in an exploit chain rather than an initial access vector. No public exploit code was identified in the provided data.