Google Chrome EUVD-2026-105433

Exploitation requires a victim using Chrome prior to 156.0.8078.47 to navigate to a crafted HTML page under attacker control (UI:R / user interaction required) - this is the primary limiting factor, as no exploitation occurs without the victim loading the malicious content. No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected since ANGLE is the standard graphics-translation backend. The key impact limiter is that successful exploitation yields code execution confined to the renderer sandbox (S:U); escaping to the host requires chaining with a separate sandbox-escape vulnerability.

This is a genuine patch-now priority for any environment running Chrome, but with an important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms a network-reachable, low-complexity, unauthenticated vulnerability requiring only that a victim load a crafted HTML page - a trivially met condition for a browser. Chrome's ubiquity amplifies the exposure. However, the description explicitly scopes the outcome to 'execute arbitrary code inside the sandbox,' meaning this flaw alone yields code execution confined to the renderer sandbox and would need to be chained with a separate sandbox-escape bug to achieve full host compromise; this is reflected in the scope-unchanged (S:U) metric. No EPSS score, KEV listing, POC, or SSVC data was supplied in the input, so exploitation-likelihood signals cannot be cross-referenced - the 8.8 score here reflects potential impact, not confirmed real-world exploitation. The 'High' Chromium severity rating (not Critical) is consistent with a sandboxed-RCE memory-corruption bug. Net: treat as high-priority remediation due to prevalence and ease of triggering, while recognizing that standalone real-world impact is limited by the sandbox and that no active-exploitation evidence is present in the provided data.

An attacker hosts or compromises a web page containing malicious content that triggers the memory-corruption flaw in Chrome's ANGLE graphics component, then lures a victim into visiting it. When the page renders, the attacker gains arbitrary code execution within the Chrome renderer sandbox, which would typically be combined with a sandbox-escape exploit to reach the underlying system. No public exploit code was identified in the provided data.