Google Chrome CVE-2026-76026

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.79) that is processed by the Autofill component - i.e., the user-interaction requirement (UI:R) is the primary limiting factor, as the attacker cannot trigger it without the victim navigating to or rendering attacker-controlled content. No authentication or special privileges are needed (PR:N, unauthenticated per the CVSS vector), and no non-default configuration is indicated. A further practical limit is scope: successful exploitation yields code execution confined to the renderer sandbox (S:U), so escaping to the host requires an additional, separate sandbox-escape vulnerability not covered by this CVE.

Signals are consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction - the victim must load attacker-controlled content. SSVC reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (user interaction breaks reliable mass automation), Technical Impact=total. EPSS is low at 0.20% (10th percentile), and there is no CISA KEV listing, so there is no evidence of active exploitation; this is a high-impact-but-currently-low-exploitation-likelihood item, consistent with the vendor's 'this_week' priority rather than an immediate drop-everything event. One scope nuance matters: the description states code execution occurs 'inside the sandbox,' so by itself this does not grant full host compromise without a separate sandbox-escape chain - the CVSS S:U (scope unchanged) and I:H/A:H reflect full impact within the renderer sandbox boundary, not the OS. No key signals conflict; the main caveat is that 'Technical Impact: total' refers to the compromised component (the sandboxed renderer), which should not be read as host-level total compromise absent a chained escape.

An attacker hosts or injects a crafted HTML page (e.g., via a malicious site, compromised ad, or iframe) and lures a Chrome user into loading it. The page triggers memory corruption in the Autofill component, achieving arbitrary code execution within the renderer sandbox. No public exploit is identified at time of analysis, and full host compromise would require chaining a separate sandbox escape.