Google Chrome EUVD-2026-93769

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process before this flaw can be triggered - this is the primary limiting factor and makes the bug a sandbox/restriction-bypass stage rather than an entry point. It additionally requires user interaction (the victim must load an attacker-controlled crafted HTML page, per UI:R), and the targeted Chrome build must be prior to 155.0.8059.39 on desktop. The specific feature abused is Chrome's FontAccess (Font Access API) authorization logic; no non-default configuration is noted, but the renderer-compromise and page-load prerequisites substantially limit realistic exploitation to attackers already chaining another vulnerability.

This is a genuine but second-stage vulnerability rather than a standalone high-priority threat. The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5) scores it as network-reachable with low complexity and no privileges, but the description explicitly requires 'a remote attacker who had compromised the renderer process' - a significant unstated precondition that the PR:N metric does not reflect. In practice exploitation presumes a prior renderer-compromise primitive (typically chained from a separate memory-corruption or RCE bug), so AC:L/PR:N understates the real barrier; this should be read as a sandbox/access-restriction bypass that extends an existing foothold, not an initial-access bug. The supporting signals all point to low real-world urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing and no public POC identified, and Google itself rated the Chromium severity only Medium. The impact is scoped to integrity (I:H, C:N/A:N), consistent with bypassing FontAccess system restrictions rather than data theft or crash. Net: patch in the normal Chrome update cycle; this is a defense-in-depth fix, not an emergency.

An attacker who has already achieved code execution in a Chrome renderer process (for example via a separate chained exploit) lures or redirects the victim to a crafted HTML page that abuses the FontAccess authorization flaw to bypass system access restrictions enforced outside the renderer. No public exploit code has been identified at time of analysis, and user interaction (visiting the page) is required.