Google Chrome CVE-2026-119270

Exploitation requires a user to visit or be redirected to an attacker-controlled HTML page with a vulnerable Google Chrome version prior to 156.0.8078.79 (UI:R user interaction is mandatory); no authentication or prior privileges are needed (PR:N). The key limiting factor is that successful exploitation yields code execution confined 'inside the sandbox' - the renderer process - so full host compromise would additionally require a separate sandbox-escape vulnerability not covered here. The precise CacheStorage input that triggers the flaw is not described in the available sources.

Signals point to a real but moderate-urgency issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable flaw needing no privileges but requiring user interaction (visiting a crafted page), with total technical impact - consistent with SSVC Technical Impact: total. However, several signals temper the raw score: SSVC reports Exploitation: none and Automatable: no, EPSS is only 0.21% (12th percentile), and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. The vuln.today Decision label is 'this_week' (not act_now/emergency), aligning with a prompt-but-not-crisis posture. A crucial scoping nuance: the description states code execution occurs 'inside the sandbox,' meaning this alone yields renderer-process compromise, not full host takeover - a sandbox escape would be required for system-level impact, which this CVE does not describe. The CVSS C:H/I:H/A:H therefore reflects impact within the sandboxed renderer under scope-unchanged. Overall: a genuine browser RCE worth patching within the vendor's suggested window, but low observed exploitation probability and sandbox confinement argue against treating it as an in-the-wild emergency.

An attacker hosts or compromises a web page containing crafted content that triggers the CacheStorage input-validation flaw; a user who browses to it with a vulnerable Chrome build has attacker-controlled code executed within the browser's sandboxed renderer process. No public exploit identified at time of analysis, and the interaction requirement (UI:R) means the victim must be lured to the malicious page.