Google Chrome CVE-2026-110921

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build (prior to 155.0.8059.84) with JavaScript/V8 enabled, which is the default configuration - matching UI:R in the CVSS vector. No authentication or prior privileges are needed (PR:N). The key LIMITING factors are: (1) mandatory user interaction - the victim must navigate to or render attacker-controlled content; (2) resulting code execution is confined to the renderer sandbox per the description, so a separate sandbox-escape vulnerability is required to compromise the underlying host; and (3) the window closes once the browser auto-updates to the patched build. No non-default setting is required to be vulnerable.

This is a genuinely high-priority browser vulnerability, though not at emergency levels based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the classic drive-by profile for browser bugs. The SSVC framework partially tempers this: Technical Impact is rated 'total' (consistent with arbitrary code execution and the C:H/I:H/A:H impact), but Exploitation is 'none' (no observed exploitation) and Automatable is 'no' (user interaction and per-target browser conditions prevent worm-like mass automation). This aligns with the exploitation signals: not in CISA KEV, and no public exploit code identified at time of analysis, so this is NOT confirmed actively exploited. One important nuance that MUST be stated: the description explicitly says code execution occurs 'inside the sandbox' - meaning this V8 use-after-free alone does NOT constitute a full host compromise and would typically need to be chained with a separate sandbox-escape bug to achieve OS-level RCE. The CVSS score of 8.8 does not reflect that mitigating boundary (scope is marked S:U, unchanged). Net assessment: real priority given Chrome's ubiquity and Google's 'High' internal severity rating, but current real-world risk is moderate rather than critical because exploitation is unobserved, not automatable, and constrained by the renderer sandbox.

An attacker hosts a malicious web page (or injects malicious content into an ad or compromised site) that triggers the use-after-free in Chrome's V8 JavaScript engine. When a victim running Chrome prior to 155.0.8059.84 visits the page, the freed-then-reused memory is manipulated to achieve arbitrary code execution within the renderer sandbox. No public proof-of-concept or active exploitation has been identified at time of analysis; realistically this bug would be combined with a sandbox escape to fully compromise the host.