Google Chrome EUVD-2026-93835

Exploitation requires the victim to be running Google Chrome prior to 155.0.8059.39 and to actively open attacker-controlled web content (UI:R) - the attacker must use social engineering to get the user to visit a crafted HTML page, as stated in the description. No authentication or special privileges are needed on the target (PR:N). The practical limiting factors are: (1) mandatory user interaction / browsing to a malicious page, which blocks silent remote exploitation; (2) resulting code execution is confined to the renderer sandbox, so escaping to the host OS requires a separate, chained sandbox-escape vulnerability; and (3) users on an auto-updated Chrome channel at or above 155.0.8059.39 are not affected.

This is a genuinely high-priority patch-soon issue, though not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring no privileges but requiring user interaction, with total confidentiality, integrity and availability impact - consistent with a CWE-416 use-after-free yielding arbitrary code execution. However, the attacker-controlled code runs inside the Chrome renderer sandbox (the description explicitly says 'inside the sandbox'), so a full host compromise would additionally require a sandbox-escape chain not covered by this CVE, which tempers the real-world impact. The signals are mostly aligned on 'serious but not actively exploited': CISA SSVC reports Exploitation=none, Automatable=no, Technical Impact=total - matching the absence of any KEV listing and no public exploit code in the references. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The requirement for user interaction (UI:R, social engineering to visit a crafted page) and non-automatability meaningfully lower the likelihood of mass, worm-style exploitation, favoring targeted use if weaponized. Net: treat as a standard high-severity browser RCE - apply the vendor update promptly - rather than a drop-everything zero-day.

An attacker crafts a malicious HTML page that abuses the use-after-free in Chrome's Select element handling and uses social engineering (phishing link, malvertising, or a compromised site) to lure a victim into opening it. When the page renders, the freed object is reused to achieve arbitrary code execution within the renderer sandbox. No public exploit code was identified at the time of analysis, and full host compromise would require an additional sandbox escape.