Google Chrome EUVD-2026-102512

Exploitation requires the victim to actively load an attacker-controlled or compromised web page containing a crafted HTML/JavaScript payload that triggers the V8 use-after-free - this mandatory user interaction (UI:R) is the primary limiting factor and prevents fully automated, wormable exploitation. No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected since V8 is the core JavaScript engine enabled by default. A second critical limiter is that resulting code execution is confined to the renderer sandbox (S:U); achieving host-level compromise would require chaining an additional sandbox-escape vulnerability. Affected: all Chrome builds prior to 155.0.8059.84; updating to 155.0.8059.84 or later removes exposure.

Signals are mostly consistent and point to a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page) and does not cross the sandbox boundary (S:U). Google rates the Chromium severity as High. The SSVC decision framework reports Exploitation: none, Automatable: no, Technical Impact: total - the 'total' technical impact aligns with the C:H/I:H/A:H impact metrics, while 'Automatable: no' is consistent with the UI:R requirement (an attacker cannot fully automate mass exploitation because a victim must load the page). There is no CISA KEV listing (SSVC Exploitation: none) and no POC indicated in the provided data; no EPSS score was supplied, so exploitation probability cannot be quantified. The description's claim of code execution 'inside the sandbox' is an important mitigating detail: by itself this UAF yields code execution confined to the renderer sandbox and would typically need to be chained with a separate sandbox-escape bug to achieve full host compromise - the S:U (scope unchanged) metric reflects this. Net: a real, patch-worthy High-severity renderer RCE that should be remediated promptly via browser update, but current evidence indicates no active or automatable exploitation, so it is routine-urgent rather than a drop-everything emergency.

An attacker hosts or injects a crafted HTML page containing JavaScript that triggers the use-after-free in Chrome's V8 engine, then lures a victim to visit it (e.g., via phishing link or malicious ad). When the page loads, the dangling pointer is reclaimed and manipulated to execute attacker-controlled code within the renderer sandbox. No public exploit code was identified at time of analysis, and successful exploitation requires the user to open the malicious page.