Google Chrome CVE-2026-119262

Exploitation requires the victim to use an unpatched Google Chrome build prior to 156.0.8078.79 and to visit a crafted/attacker-controlled HTML page (UI:R - user interaction required, consistent with a web-content attack). No authentication is required (PR:N). A key limiting factor is scope: the description explicitly states code execution occurs 'inside the sandbox' (S:U), so a successful exploit is contained within the renderer process and would require chaining a separate sandbox-escape vulnerability to compromise the underlying host. No special non-default Chrome configuration is indicated as necessary.

Signals are consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a remote, low-complexity, unauthenticated attack that requires user interaction (visiting a crafted HTML page) and yields high confidentiality, integrity, and availability impact. Crucially, the description states code execution occurs 'inside the sandbox' (scope S:U), so this is NOT by itself a full host compromise - it would need to be chained with a sandbox-escape bug to achieve persistent system-level control. KEV is not listed and SSVC Exploitation is 'none', so there is no evidence of active exploitation; EPSS is low at 0.24% (15th percentile), consistent with the absence of observed exploitation. SSVC Technical Impact is 'total' but Automatable is 'no' (user interaction is required), which tempers mass-exploitation risk. The vuln.today Decision label is 'this_week', reflecting a high-severity browser RCE with an available patch that should be deployed promptly but is not flagged as act_now/emergency. Net: a genuine high-priority patch item for any Chrome fleet, but current real-world exploitation risk is moderate rather than urgent, and the sandbox containment is a meaningful mitigating factor.

An attacker hosts or compromises a web page containing malicious JavaScript that abuses the V8 input-validation flaw; a victim using an unpatched Chrome (prior to 156.0.8078.79) simply visits the page and the attacker achieves code execution within the renderer sandbox. No public exploit code was identified at time of analysis, and the specific trigger is not described in the available sources. Real-world impact beyond the sandbox would require chaining a separate sandbox-escape vulnerability.