Google Chrome EUVD-2026-105425

Exploitation requires the victim to open an attacker-controlled HTML page in a vulnerable Chrome build prior to 156.0.8078.47 (desktop stable channel); this is the UI:R user-interaction requirement and the primary limiting factor. No authentication, special privileges, or non-default configuration is needed - the vulnerable V8 JavaScript engine is enabled by default when rendering web content. The impact is further limited to reading memory within the renderer sandbox (confidentiality only, C:H/I:N/A:N); no code execution, data modification, or sandbox escape is described, so the attacker gains disclosure of in-sandbox memory rather than host control.

This is a genuinely moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 because exploitation is network-reachable and requires no privileges, but it is gated by user interaction (the victim must open a crafted HTML page) and the impact is confined to confidentiality only - the flaw 'allowed a remote attacker to potentially read memory inside the sandbox,' meaning information disclosure rather than code execution or a sandbox escape. The low integrity/availability impact and the word 'potentially' in Google's description indicate a memory-read primitive, not a full compromise. Corroborating signals point the same way: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so this is not under active or widespread exploitation. The main caveats: V8 memory-corruption bugs are frequently chained toward RCE/sandbox escape in Chrome, and Chromium-rated 'High' severity bugs sometimes attract later exploitation, so this should be patched promptly despite the unremarkable EPSS. Note also that Google's CVSS C:H rating for a read-only sandbox-internal disclosure is somewhat generous; the practical severity depends on what sensitive in-sandbox data is exposed.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) containing JavaScript that triggers the V8 memory-corruption condition. When a victim running a vulnerable Chrome build visits the page, the attacker's code reads memory within the renderer sandbox, potentially harvesting sensitive data from other content in the process. No public exploit was identified at time of analysis, and successful exploitation requires the victim to actively load the attacker-controlled page.