Google Chrome EUVD-2026-93833

Exploitation requires the victim to load attacker-controlled HTML content in a vulnerable Chrome build prior to 155.0.8059.39 - i.e., visiting a malicious or compromised web page (UI:R user interaction is mandatory). No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected since the flaw is in core HTML handling. The key limiting factor beyond user interaction is that successful exploitation yields code execution only inside the renderer sandbox; reaching the underlying operating system would require an additional, separate sandbox-escape vulnerability not covered by this CVE.

Multiple signals align on elevated-but-not-maximal priority. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction - consistent with the description's 'crafted HTML page' delivery, where UI:R means the victim must visit a malicious or compromised site. The vendor (Chrome) rates the Chromium severity 'High'. A critical mitigating detail: the description explicitly states code execution is 'inside the sandbox,' meaning this is a renderer-process compromise and NOT a full host takeover on its own - a sandbox escape would be needed to reach the OS, which is why Scope remains Unchanged (S:U). On exploitation signals, there is no EPSS score, no KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis; this contrasts with the high CVSS and means urgency rests on prevalence and vendor-confirmed exploitability rather than observed in-the-wild activity. UAF bugs in Chrome's HTML/DOM handling are historically weaponizable and frequently chained, so the realistic risk is meaningful despite the absence of current exploitation evidence. Net: patch-now priority because of Chrome's ubiquity and the proven exploitability class, tempered by sandbox containment and no confirmed active exploitation.

An attacker hosts or injects a crafted HTML page and lures a victim to open it in a vulnerable Chrome build (UI:R), triggering a use-after-free in HTML/DOM handling to corrupt memory and execute arbitrary code within the renderer sandbox. No public exploit is identified in the provided data, but UAF flaws of this class are routinely developed into reliable exploits, typically as the first stage of a chain that would still require a separate sandbox escape to compromise the host.