Google Chrome EUVD-2026-93795

Exploitation requires the victim to load attacker-controlled web content in Chrome prior to 155.0.8059.39 - i.e., visiting a malicious page or rendering a malicious iframe/ad that executes a crafted navigation sequence (consistent with UI:R in the CVSS vector). No authentication or special Chrome configuration is required (PR:N, default browser behavior), so standard default installs are affected. The key limiting factors are: (1) mandatory user interaction to open the content, and (2) the inherent difficulty of weaponizing a UAF into a reliable sandbox escape, which typically demands heap grooming and may require chaining with an additional primitive - reflected in SSVC Automatable:no.

This is a genuine high-priority vulnerability, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free in Chrome's Navigation component that achieves a scope change (S:C) - consistent with the description's claim of code execution OUTSIDE the renderer sandbox, which is the worst class of browser bug because it breaks the primary containment boundary. However, the signals are not uniformly alarming: CISA's SSVC decision framework reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no public POC in the provided data, so there is no public exploit identified at time of analysis. The one tension to note: SSVC Automatable:no while CVSS is AC:L - this is reconcilable because reliable UAF/sandbox-escape exploitation typically requires precise heap grooming and often chains with a second bug, so it is not trivially mass-automatable even though the triggering vector is simple. The practical limiter is UI:R: a victim must load attacker-controlled content. Net: patch urgently given Chrome's ubiquity and the sandbox-escape impact, but current evidence points to no active exploitation.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) that drives a crafted navigation sequence triggering the use-after-free in Chrome's Navigation code. When a victim visits the page, the freed object is reclaimed and manipulated to corrupt memory and execute attacker code outside the browser sandbox. No public exploit is identified at time of analysis, and the attack requires user interaction (visiting the page).