Google Chrome CVE-2026-119272

Exploitation requires a victim running Google Chrome prior to 156.0.8078.79 to open or render an attacker-crafted HTML page (CVSS UI:R); it is unauthenticated (PR:N) but is not a drive-by against a passive target with no interaction. The impact is bounded: the out-of-bounds read discloses memory only inside the renderer sandbox (C:L, no I/A impact), so it does not by itself grant code execution or a sandbox escape. The specific FileSystem feature or input condition that triggers the read is not detailed in the available sources. Limiting factors: required user interaction, the need for an unpatched browser version, and the confinement of the leak to sandboxed memory.

This is a genuine but low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - network-reachable and unauthenticated (PR:N), but it requires user interaction (UI:R, the victim must open a crafted page) and yields only a limited confidentiality impact (C:L) with no integrity or availability impact. Google itself rated the Chromium security severity as Medium. The supporting intelligence reinforces the modest risk: EPSS is 0.16% (5th percentile), there is no CISA KEV listing (exploitation=none in SSVC), the flaw is not automatable (SSVC Automatable=no), and technical impact is only partial. CWE-125 (out-of-bounds read) matches the description of reading memory, and crucially the read is confined to memory inside the renderer sandbox, so it is an information-disclosure primitive rather than a sandbox escape or code execution. The vuln.today priority of 'this_month' aligns with a routine-patch posture rather than emergency action. No signals conflict here: high ubiquity of Chrome is offset by low exploitation probability, required user interaction, and limited impact. Treat it as part of the normal Chrome update cycle, not an incident.

An attacker hosts a crafted HTML page (or injects it into a site/ad the victim already visits) that triggers the out-of-bounds read in Chrome's FileSystem component when rendered. A victim running Chrome prior to 156.0.8078.79 opens the page, and the attacker's script reads adjacent memory inside the renderer sandbox, potentially leaking sensitive in-process data. No public exploit has been identified at time of analysis, and exploitation still requires the user to visit the attacker-controlled page.