Google Chrome EUVD-2026-93824

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.39 (UI:R - user interaction via visiting attacker-controlled content). No authentication or special configuration is needed (PR:N), and default Chrome installations are affected. The key limiting factor is that resulting code execution is confined to the renderer sandbox (S:U) - the description specifies execution 'inside the sandbox,' so a separate sandbox-escape vulnerability would be required to compromise the underlying host, significantly constraining standalone impact.

This is a genuine high-priority issue despite the absence of confirmed exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remote, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page, with full confidentiality, integrity, and availability impact - a classic browser drive-by profile. The CWE-416 use-after-free in the Parser is the single most weaponized bug class in modern browsers and Chromium rates it High severity. No CISA KEV listing and no public POC were provided, so there is no evidence of active or imminent exploitation yet; EPSS and SSVC data were not supplied in the input and cannot be assessed. The signals are therefore consistent rather than conflicting: high theoretical severity, patch already shipped, but no confirmation of real-world exploitation at time of analysis. Note the scope limitation - the description explicitly states code executes 'inside the sandbox,' meaning this is NOT a sandbox escape (S:U), so a second vulnerability would be required to reach the host. This materially lowers real-world impact versus a full RCE and should temper urgency slightly, though browser UAF bugs are frequently chained and historically exploited, so patching should not be deferred.

An attacker hosts or compromises a web page containing malicious HTML crafted to trigger the use-after-free in Chrome's parser, then lures a victim to visit it (phishing link, malvertising, or watering hole). When the victim's browser parses the page, the freed object is reused and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided data, and exploitation requires the user to open the page (UI:R).