Chrome EUVD-2025-18071

CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/S:U indicates high severity: network-accessible, low attack complexity, no privilege requirements, requires only user interaction (UI:R), and unscoped impact (confined to the sandboxed process). The attack vector is practical—malicious websites or compromised legitimate sites can deliver the exploit. While the vulnerability is sandboxed (S:U suggests no escape from sandbox context described), the code execution within sandbox context combined with potential chaining attacks elevates risk. Without confirmed EPSS score or active exploitation data (KEV status unknown from provided data), real-world risk assessment depends on: (1) whether POC exists in public domain (not confirmed here), (2) whether Chrome sandbox escape chains are known, and (3) deployment prevalence of vulnerable versions. The requirement for user interaction lowers automated exploitation probability, but social engineering or drive-by downloads reduce this friction. Priority assessment: HIGH—apply patches urgently, though not as critical as remote unauthenticated code execution outside sandbox.

An attacker creates a malicious HTML page containing JavaScript code that exploits the type confusion in V8. When a victim visits this page (via email link, ad, social engineering, or compromised website), the browser parses the HTML and executes the JavaScript. The crafted JavaScript triggers the type confusion, causing V8 to misidentify the type of an object and execute attacker-controlled code with the privileges of the sandboxed renderer process. The attacker could: (1) steal sensitive data from open tabs (cookies, credentials, local storage), (2) perform actions on behalf of the user (send emails, posts, transactions), or (3) use this as a pivot point for sandbox escape (if combined with other vulnerabilities) to access the host system. Example: attacker hosts exploit.html on attacker-controlled domain, embeds it in a forum post or advertisement, or creates a phishing email linking to it. The attack requires minimal user interaction (just visiting a link), making it viable for large-scale compromise via ad networks or watering-hole attacks targeting specific user groups.