Google Chrome EUVD-2026-93807

Exploitation requires that the attacker has ALREADY compromised Chrome's sandboxed renderer process via a separate prior vulnerability - this bug is a sandbox-escape primitive, not an initial-access vector. Beyond that prerequisite, the victim must load/visit a crafted HTML page (UI:R), and the attacker must win a timing-dependent race condition in the Fonts component (reflected in AC:H), which is inherently unreliable and non-deterministic. The exploit is limited to Chrome versions prior to 155.0.8059.39; patched builds are not affected. These factors - mandatory prior renderer compromise, required user interaction, and the difficulty of winning the race - substantially constrain realistic exploitation despite the high base score.

This is a genuine high-priority defense-in-depth flaw rather than a standalone catastrophic bug. The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) encodes a scope-changing sandbox escape with total technical impact, consistent with SSVC's 'Technical Impact: total'. However, three signals temper the urgency: AC:H reflects that winning the race condition (CWE-362) is non-trivial, SSVC 'Exploitation: none' and 'Automatable: no' indicate no observed exploitation and no reliable automation, and KEV status is absent with no POC referenced - yielding 'no public exploit identified at time of analysis'. The most important caveat is a tension between the CVSS vector and the description: the vector shows PR:N (no privileges), but the description explicitly requires 'a remote attacker who had compromised the renderer process' first. This is a classic second-stage sandbox-escape primitive that is only useful when chained to a prior renderer RCE, so the PR:N score overstates standalone exploitability - verify intended use as a chain component. Net: patch promptly given the ubiquity of Chrome and total impact, but this is not a wormable, immediately-exploitable internet-facing threat on its own.

An attacker who has already achieved code execution inside Chrome's sandboxed renderer (via a separate vulnerability) lures or directs the victim to a crafted HTML page that triggers a timing-dependent race condition in the Fonts component. By winning the race, the attacker breaks out of the renderer sandbox (S:C) and executes arbitrary code in a higher-privileged browser process. No public exploit code was identified at the time of analysis, and AC:H means the race window must be won reliably, which is difficult in practice.