Google Chrome EUVD-2026-105422

Exploitation requires the victim to use Google Chrome on Windows at a version prior to 156.0.8078.47 and to load an attacker-controlled HTML page that exercises the vulnerable ANGLE (graphics/WebGL translation layer) rendering path - this user-interaction step (UI:R) is the primary limiting factor. No authentication or pre-existing access is needed (PR:N), and default Chrome configurations are affected since ANGLE is the standard graphics backend. The critical containment factor is that code execution is confined to the Chrome sandbox (S:U, 'inside the sandbox'), so this bug alone does not grant host-level control without being chained to a separate sandbox-escape vulnerability.

This is a genuine patch-priority issue despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 HIGH) describes a network-reachable, low-complexity, unauthenticated memory-corruption (CWE-119) flaw in ANGLE triggered by visiting a crafted HTML page - the classic drive-by browser attack surface, requiring only that the victim load a malicious page (UI:R). The signals are internally consistent: Google's own Chromium team reported it, a fix exists, and Chrome's enormous install base makes it an attractive mass-exploitation target. However, several escalation signals are MISSING rather than negative: there is no KEV listing, no EPSS score was supplied, and no public POC is referenced, so 'no public exploit identified at time of analysis' is the accurate status. One important mitigating nuance from the description itself: code execution is 'inside the sandbox' (consistent with S:U - no scope change), meaning this bug alone yields renderer-process compromise, not full host takeover; a practical full-system attack would need to be chained with a separate sandbox-escape. Note also the description's doubled phrasing ('on on Windows') and that affected versions are stated oddly as 'Chrome 156.0.8078.47 <156.0.8078.47' - a likely data-entry artifact meaning 'all versions prior to 156.0.8078.47'.

An attacker hosts or compromises a web page containing malicious WebGL/graphics content that drives ANGLE through a crafted rendering path, and lures a Chrome-on-Windows user to visit it (phishing link, malvertising, or watering-hole). When the page loads, the memory-corruption bug is triggered in the renderer and the attacker gains arbitrary code execution within the Chrome sandbox. No public exploit is identified at time of analysis, and the attack requires user interaction (loading the page) but no authentication.