Google Chrome EUVD-2026-93846

Exploitation requires a victim using Chrome prior to 155.0.8059.39 to actively open a crafted HTML page that drives the vulnerable Media component into a use-after-free (CVSS UI:R). No authentication or prior privileges are needed (PR:N), and the attack works against default configurations since media handling is a core browser feature - but the mandatory user interaction (navigating to attacker-controlled content) is the key limiting factor, meaning it cannot be triggered without luring the user. A further material limit is containment: code execution occurs within the renderer sandbox (S:U), so a separate sandbox-escape vulnerability would be required to impact the underlying host.

Signals are largely consistent but point to a serious, not-yet-exploited browser flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, 8.8) indicates a remote, low-complexity, unauthenticated attack that nonetheless requires user interaction (victim must open a crafted HTML page). CISA SSVC reinforces this: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (user must be lured to a page, so it does not mass-scan/worm trivially), but Technical Impact 'total' (full code execution within the targeted process). Critically, the description states execution occurs 'inside the sandbox' - Chromium's renderer sandbox contains the compromise, so without a chained sandbox-escape this does not by itself yield host takeover; the S:U (scope unchanged) metric is congruent with that containment. There is no KEV listing and no POC indicator in the data, so exploitation status is 'no public exploit identified at time of analysis.' Net: a genuine high-priority patch item for any Chrome fleet because of the ubiquity and total in-process impact, but the user-interaction requirement and sandbox containment make it a drive-by/targeted risk rather than an automatable mass-exploitation threat. No key signals conflict; the main caveat is that 'arbitrary code inside the sandbox' is more limited than unsandboxed RCE, which the raw 8.8 does not convey.

An attacker hosts or compromises a web page containing malicious media content and lures a victim running a vulnerable Chrome build to visit it (phishing link, malvertising, or compromised site). When the page's media is processed, the use-after-free in the Media component is triggered, letting the attacker execute arbitrary code within the renderer sandbox. No public exploit code is identified at time of analysis, and a sandbox escape would be needed to fully compromise the host.