Google Chrome CVE-2026-76028

Exploitation requires a user of an unpatched Chrome build (any version prior to 156.0.8078.79) to load attacker-controlled crafted HTML that exercises the FileSystem component - this user interaction (UI:R: visiting the page) is the primary limiting factor, preventing fully automated/wormable exploitation. No authentication and no special non-default configuration are indicated by the CVSS vector (PR:N) or description; default Chrome configurations are affected. The key limit on real-world impact is scope: the description confines resulting code execution to inside the renderer sandbox, so damaging the host would require an additional, separate sandbox-escape vulnerability not covered here. The precise trigger mechanism beyond 'crafted HTML page' and the use-after-free class is not described in the available sources.

Signals are largely consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction (the victim must load a crafted HTML page). SSVC counters the raw severity: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (user interaction breaks mass-automation), while Technical Impact is 'total' - matching the C:H/I:H/A:H impact. EPSS is low at 0.20% (10th percentile), agreeing with SSVC that widespread opportunistic exploitation is currently unlikely. This is NOT a CISA KEV entry, so there is no confirmed active exploitation. The vuln.today decision label is 'this_week', i.e. patch promptly but not an emergency - coherent with low EPSS, no KEV, and a patch already shipped. One important scoping nuance: the description states code executes 'inside the sandbox', so the C:H/I:H/A:H and SSVC 'total' impact apply to the renderer sandbox, not the host; full host compromise would require chaining a separate sandbox-escape, which this CVE does not provide. Net: a genuine high-severity browser memory-corruption bug worth prioritizing in normal patch cycles, but not a drop-everything scenario on current signals.

An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's FileSystem component when a victim visits it. Successful exploitation yields arbitrary code execution within the renderer sandbox; no authentication is required but the victim must load the page (UI:R). No public exploit code is identified in the provided data, and SSVC marks exploitation as 'none'.