Google Chrome CVE-2026-119263

Exploitation requires the victim to load attacker-controlled content in Chrome - the CVSS vector's UI:R and the description's 'via a crafted HTML page' confirm user interaction (visiting/rendering a malicious page) is mandatory; there is no server-side or zero-click path in the available data. No authentication is required (PR:N), and it works against default configurations since Chrome renders HTML by default. The principal limiting factors are: (1) the user must visit or be redirected to the malicious page, (2) the victim must be running a Chrome build prior to 156.0.8078.79, and (3) the flaw must be chained to escape the sandbox (Scope:Changed) to achieve host code execution rather than mere renderer compromise. SSVC marks this not automatable, consistent with the per-victim interaction requirement.

Signals conflict, and the conflict is the story. The CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is driven high by the Scope:Changed metric, reflecting that the flaw reportedly allows code execution OUTSIDE the Chrome sandbox - a renderer-to-host boundary crossing with total confidentiality, integrity, and availability impact. Against that, the exploitation signals are cool: EPSS is only 0.20% (10th percentile), there is no CISA KEV listing, and SSVC reports Exploitation:none with Automatable:no (consistent with a flaw that needs a user to load a page, not a wormable server-side bug). SSVC Technical Impact:total agrees with the CVSS C/I/A:H. So this is a case of high technical severity with no evidence of current exploitation. The reconciling factor is the vuln.today Decision label of 'act_now', which for a browser sandbox escape is a defensible prioritization even absent active exploitation, because Chrome's install base and the low barrier (merely visiting a crafted page) mean the window between patch disclosure and exploit development is typically short. Net: treat as a real priority for patch deployment based on impact and product reach, not because widespread exploitation is confirmed - it is not. No public exploit is identified in the provided data, and the low EPSS indicates no current mass-exploitation pressure.

An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption condition in Chrome's garbage collector when a victim running a pre-156.0.8078.79 build visits it. Successful corruption is leveraged to execute arbitrary code outside the browser sandbox, giving the attacker code execution on the victim host. No public exploit code is identified in the available data; the specific trigger mechanism is not described in the sources.