Google Chrome EUVD-2026-93794

Exploitation requires the victim to open an attacker-controlled web page containing crafted HTML in an unpatched Chrome build prior to 155.0.8059.39 (CVSS UI:R) - there is no requirement for authentication, special privileges, or non-default configuration, so default Chrome installs are affected. The key limiting factor is this mandatory user interaction (navigation to malicious content), which rules out zero-click or self-propagating exploitation but is readily achieved through phishing, malvertising, or compromised sites. The bug's value is amplified because it executes outside the sandbox, meaning a single successful page load can lead to host-level code execution rather than being contained to the renderer.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) whose scope change (S:C) and 'outside the sandbox' language indicate a full browser sandbox escape - the most severe class of Chrome bug, corroborated by Chromium's own 'Critical' severity rating and the SSVC 'Technical Impact: total' judgment. The signals are, however, not uniformly alarming: SSVC reports 'Exploitation: none' and 'Automatable: no', there is no CISA KEV listing, and no public POC or EPSS score was supplied, so there is no current evidence of in-the-wild or large-scale automated exploitation. The one friction factor is UI:R - a victim must open attacker-controlled content - which prevents fully automatic mass exploitation but is trivially satisfied via drive-by web pages, phishing links, or malvertising. Net assessment: patch urgently despite the absence of known exploitation, because the product is ubiquitous, the technical impact is total, and Chrome sandbox-escape UAFs are historically weaponized quickly once details circulate.

An attacker lures a user into visiting a malicious or compromised web page containing crafted HTML that triggers the use-after-free in Chrome's Browser process. Because the flaw yields code execution outside the renderer sandbox, successful exploitation gives the attacker arbitrary code execution on the victim host with the user's privileges. No public exploit was identified at time of analysis, so this scenario is based on the vulnerability class and CVSS characteristics rather than an observed exploit.