Google Chrome EUVD-2026-93836

Exploitation requires that the attacker has ALREADY compromised Chrome's sandboxed renderer process (typically via a separate renderer vulnerability) - this flaw is a sandbox-escape primitive, not an initial-access bug. The victim must then load attacker-controlled crafted HTML (UI:R) that drives the use-after-free in the Metrics component. Limiting factors: the renderer-compromise prerequisite, the required user interaction (visiting/loading the malicious page), High attack complexity (AC:H) reflecting the need to win a use-after-free race and defeat sandbox mitigations, and that users on versions at or above 155.0.8059.39 are not affected. No non-default configuration is described; the condition is the chained renderer compromise rather than a specific product setting.

Signals point to a patch-promptly-but-not-emergency posture. The CVSS 3.1 score is 8.3 (High) with S:C C:H/I:H/A:H reflecting a sandbox escape to full-host code execution, but it is tempered by AC:H and, critically, UI:R plus the description's requirement that the attacker must ALREADY have compromised the renderer process - this is a second-stage sandbox-escape primitive, not a standalone remote exploit. CISA's SSVC framework aligns with a lower urgency: Exploitation=none, Automatable=no, Technical Impact=total; so despite 'total' impact, there is no observed exploitation and the attack is not automatable. There is no CISA KEV listing and no public POC identified in the input, so this is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so exploitation-probability cannot be weighed - this is a data gap. Note the apparent tension flagged by the vendor: the CVSS vector encodes PR:N (unauthenticated) yet the description requires a pre-compromised renderer, meaning realistic exploitation is chained and conditional rather than trivially remote - verify how the vendor intends PR:N to be read. Net: a widely deployed product (Chrome) with a serious impact ceiling, but gated behind a renderer-compromise prerequisite and no evidence of in-the-wild use, so prioritize via normal browser patch cadence rather than emergency response.

An attacker who has already gained code execution inside Chrome's sandboxed renderer (via a separate renderer bug) lures or keeps a victim on a crafted HTML page that triggers the use-after-free in the Metrics component. Exploiting the freed object lets the attacker break out of the renderer sandbox and run arbitrary code with the browser process's privileges on the host. No public exploit code is identified in the provided data, and attack complexity is High.