The CVSS 8.8 score for CVE-2026-76021 is technically accurate but analytically incomplete. This DOM use-after-free in Chrome versions prior to 151.0.7922.173 does enable arbitrary code execution—but that execution is contained within Chrome's sandbox architecture, and collapsing sandboxed RCE into the same risk category as unsandboxed host compromise produces materially flawed prioritization decisions.
The sandbox is not cosmetic. A successful exploit grants code execution within the renderer process, which Chrome isolates from the host operating system. For most organizations, the practical impact is containment at the browser level—not lateral movement to the underlying system. This does not make the vulnerability unimportant, but it does mean your threat model should treat sandboxed RCE differently than the CVSS score implies.
However, the credential blast radius lens changes the calculus. Modern browser sessions guard SSO tokens, authenticated SaaS access, cloud storage credentials, and internal tool sessions. If an attacker achieves sandboxed RCE, the target is not your filesystem—it's everything the user is logged into. From this angle, the sandbox contains host-level blast radius but does not reduce the field of collateral damage. The question is not whether the attacker escapes to the host, but what authenticated sessions the user holds that become accessible.
The EPSS score of 0.00375 currently indicates low automated exploitation, but note that this class of DOM UAF has appeared with clockwork regularity in Chrome's CVE feed since at least 2019. Each iteration refined against prior mitigations—PartitionRefCount, Oilpan improvements, renderer process isolation—while the underlying architectural substrate (the async boundary between JavaScript reference counting and C++ object lifetimes) keeps producing the conditions. The exploitation toolkit for this class has become commoditized; what remains difficult is the sandbox escape chain. This means the gap between sandboxed RCE and host compromise is narrowing, not disappearing.
For your inventory: verify patch status across all Chromium-based browsers in your fleet—Edge, Brave, Vivaldi, and any enterprise-deployed derivatives inherit this vulnerability but may not auto-update on Chrome's cadence. Ownership of that inventory is often ambiguous, and the fragmentation itself is a process risk independent of the CVE.
Weigh this vulnerability not as an isolated event but as part of an established lineage. Your patching cadence for DOM UAFs should reflect the class's recurrence pattern, not just this CVE's individual score.