Google Chrome EUVD-2026-100628

Exploitation requires the victim to use an affected Google Chrome build (prior to 155.0.8059.79) and to interact with attacker-influenced content - visiting a malicious/compromised web page or processing attacker-crafted network traffic that reaches Chrome's network process (UI:R). No authentication or prior privileges on the target are needed (PR:N), and default Chrome configurations are affected. The key LIMITING factors are: (1) required user interaction, so it cannot self-propagate (SSVC Automatable=no); (2) the attacker must win the memory-corruption groom to turn the use-after-free into reliable code execution; and (3) only unpatched versions below 155.0.8059.79 are vulnerable, so the patch fully closes the window.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose scope change (S:C) and 'outside the sandbox' wording confirm a full browser sandbox escape - the most serious class of browser bug. SSVC tempers urgency: Technical Impact is 'total' (consistent with arbitrary code execution), but Exploitation is 'none' (no observed exploitation) and Automatable is 'no' (UI:R means a victim must visit/interact with attacker content, so it cannot be mass-wormed). This CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The signals are therefore consistent rather than conflicting: critical technical impact and easy network reach, but gated by required user interaction and no current evidence of in-the-wild use. One point to verify: the description says exploitation is 'via crafted network traffic,' which reads as more passive than the official UI:R rating implies - treat the network process as attacker-reachable whenever the user is browsing, and patch promptly given Chrome's ubiquity and attackers' historical speed at weaponizing n-day Chrome UAFs.

An attacker lures a victim to a malicious or compromised website (or injects content via a man-in-the-middle position) that sends specially crafted network responses. These responses trigger a use-after-free in Chrome's network stack, which the attacker grooms to achieve arbitrary code execution outside the renderer sandbox on the victim's host. No public exploit code is identified at time of analysis, and user interaction (visiting the page) is required.