Google Chrome CVE-2026-119261

Exploitation requires a victim to load attacker-controlled content in an unpatched Google Chrome before version 156.0.8078.79 - the UI:R metric means a user must open a crafted HTML page; there is no self-propagating or zero-interaction path. No authentication is required (PR:N) and no special non-default configuration is indicated; the flaw is reachable against a default Chrome installation that renders the malicious page. The scope-changed (S:C) outcome is a potential escape from the renderer sandbox to execute code on the host. The principal limiting factors are the mandatory user interaction (visiting or being redirected to the malicious page) and the need for the browser to be unpatched; these, together with SSVC Automatable: no, constrain realistic exploitation below what the 9.6 score alone suggests.

Signals diverge in a way worth stating plainly. The CVSS 3.1 base score is 9.6 (Critical) with AV:N/AC:L/PR:N/UI:R/S:C - network-reachable, low-complexity, unauthenticated, requiring only that a victim load a page, and crossing a trust boundary (sandbox escape) to achieve total C/I/A impact. Against that, the exploitation signals are modest: EPSS is 0.21% (12th percentile), the SSVC framework records Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit was identified in the provided data. These point to a serious-but-not-yet-exploited condition rather than mass exploitation. The input's vuln.today Decision label is 'act_now', which conflicts with the low EPSS and SSVC 'exploitation: none' reading; the urgency is best explained by the combination of total technical impact, a ubiquitously deployed product, and an available vendor patch, not by evidence of in-the-wild activity. SSVC Automatable: no is consistent with the UI:R requirement, since exploitation needs a user to visit attacker content and cannot be fully self-propagating. Net: treat as a real high priority to patch because of impact and footprint, while recognizing the exploitation-probability signals are currently low; following the act_now Decision label, patch now.

An attacker hosts a web page containing crafted content that reaches the Skia graphics library, and lures or directs a victim running an unpatched Chrome (prior to 156.0.8078.79) to open it (UI:R). The malformed input triggers the improper input validation (CWE-20) in Skia and, because the scope changes (S:C), the attacker can potentially execute arbitrary code outside the renderer sandbox. No public exploit code was identified in the provided data, and the specific trigger mechanism is not described in the available sources.