Google Chrome EUVD-2026-100661

Exploitation requires the victim to open an attacker-crafted HTML page in a vulnerable Chrome build (prior to 155.0.8059.79) that triggers the use-after-free in the FileSystem component - i.e., user interaction is mandatory (UI:R: the user must navigate to or load the malicious content). No authentication is required (PR:N, unauthenticated). The primary limiting factors are: (1) required user interaction to load the page, (2) the target must be running an unpatched Chrome version, and (3) per CISA SSVC the attack is not automatable, indicating it is not trivially mass-deployable. A successful exploit must also defeat Chrome's sandbox to realize code execution on the host.

Signals conflict sharply and must be reconciled before prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated sandbox-escape requiring only that a victim load a crafted HTML page - a classic high-impact browser bug. However, Google's own Chromium severity rating is 'Medium', and CISA's SSVC decision records Exploitation: none, Automatable: no, Technical Impact: total. These are not fully contradictory: 'Technical Impact: total' aligns with the C:H/I:H/A:H and sandbox escape, while 'Automatable: no' and 'Exploitation: none' indicate it cannot currently be driven at scale and is not observed being used. No EPSS score was supplied, so statistical exploitation probability cannot be cited. There is no CISA KEV listing and no public exploit referenced. Net: this is a genuinely serious memory-corruption flaw (sandbox escape = full host compromise if exploited), but present real-world urgency is tempered - exploitation is not confirmed, not automatable, and requires user interaction. The CVSS 9.6 vs. Chromium 'Medium' discrepancy should be flagged to stakeholders: treat as a high-priority patch given the impact ceiling and ubiquity of Chrome, not as an active-incident emergency.

An attacker hosts or compromises a web page containing JavaScript that triggers a use-after-free in Chrome's FileSystem component. When a victim browses to the page, the freed-object reuse is manipulated to corrupt memory and execute attacker-controlled code outside the renderer sandbox. No public proof-of-concept is referenced; exploitation requires the victim to actively load the malicious page (UI:R), and SSVC marks the bug as not automatable.