Google Chrome EUVD-2026-100635

Exploitation requires the victim to open or load a crafted file that is processed through Chrome's bundled ThirdParty lzma_sdk (LZMA/7-Zip SDK decompression) code path - the attacker cannot trigger it without this user interaction (UI:R in the CVSS vector). It affects default Chrome configurations prior to 155.0.8059.79 and needs no authentication (PR:N), but the following factors LIMIT real-world risk: mandatory user interaction to open the attacker-supplied file, the disclosure being confined to memory inside the Chrome sandbox (S:U, no sandbox escape), and only a partial confidentiality impact (C:L) with no code execution, integrity, or availability effect.

Multiple signals converge on this being a genuine but low-priority issue rather than a high-urgency threat. The CVSS 3.1 base score is only 4.3 (Medium) despite Chromium labeling the internal severity 'High' - the discrepancy reflects that the vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) limits impact to a partial confidentiality read (C:L) with no integrity or availability effect, and crucially requires user interaction (UI:R). The read is explicitly bounded to memory 'inside the sandbox,' so Chrome's sandbox is not escaped, further capping impact. EPSS is very low at 0.16% (5th percentile), and CISA's SSVC framework scores Exploitation=none, Automatable=no, Technical Impact=partial - all three independent signals agree this is not under active exploitation and not easily weaponized at scale. The vulnerability is NOT listed in CISA KEV and no public exploit code was identified in the provided data. No signals conflict here: low EPSS, no KEV, no POC, user-interaction requirement, and sandbox-bounded partial information disclosure all point the same direction. This is a legitimate memory-disclosure bug worth patching via normal Chrome update cadence but does not warrant emergency prioritization.

An attacker crafts a malicious file (e.g., an archive exploiting the bundled lzma_sdk decompression path) and lures a victim into opening or loading it in Chrome; the uninitialized variable causes the renderer to read leftover memory contents from within the sandboxed process. No public proof-of-concept was identified at time of analysis, and because user interaction is required (UI:R) the attacker must rely on social engineering to trigger the flaw.