Google Chrome EUVD-2026-93796

Exploitation requires a victim running Google Chrome prior to 155.0.8059.39 to load attacker-controlled HTML that drives the vulnerable 'Track' code path (associated with media/text track handling); the flaw works against default configurations with no authentication (PR:N). The primary limiting factor is mandatory user interaction (UI:R) - the victim must navigate to or be redirected to the malicious page. A second major limiting factor is that code execution is confined to the renderer sandbox ('inside the sandbox' per the description), so full host compromise additionally requires a separate sandbox-escape vulnerability not covered here.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a low-complexity, unauthenticated, network-reachable flaw whose only gating factor is user interaction - a victim visiting a malicious page. Google/Chromium rated the underlying issue Critical, and a vendor patch is available, which are strong signals of a genuinely serious memory-safety bug. However, several real-world risk signals are MISSING: no EPSS exploitation-probability score was provided, the CVE is NOT on the CISA KEV list, and no public POC is indicated - so there is no evidence of active or imminent widespread exploitation at time of analysis. A crucial limiting nuance the raw 8.8 obscures: the description states code executes 'inside the sandbox,' meaning this is a renderer-process compromise that by itself does NOT yield full host control - a separate sandbox-escape would be required for system-level impact, so the CVSS H/H/H impact reflects renderer-scope data rather than confirmed OS compromise. Net: treat as a high-priority patch given ubiquitous Chrome deployment, Critical vendor rating, and trivial attack complexity, but note the absence of exploitation-maturity data and the sandbox containment that tempers worst-case impact.

An attacker hosts or compromises a web page containing specially crafted HTML that exercises the vulnerable Track code path; when a victim's Chrome browser (pre-155.0.8059.39) renders it, a use-after-free is triggered and the attacker achieves arbitrary code execution within the renderer sandbox. No authentication is required, but the victim must be lured into visiting the page (UI:R). No public exploit code was identified in the provided data, though the Critical rating suggests practical exploitability.