Google Chrome EUVD-2026-105437

Exploitation requires the victim to load attacker-controlled HTML in Chrome prior to 156.0.8078.47 - the UI:R metric confirms user interaction (navigating to or rendering a crafted page) is mandatory, which is the primary limiting factor. No authentication or special privileges are needed (PR:N). A key containing constraint: resulting code execution is confined to the renderer sandbox (S:U), so this flaw alone does not compromise the host OS and would need to be chained with a sandbox-escape vulnerability for full system impact. No non-default configuration is indicated; standard desktop Chrome is affected.

This is a genuine high-priority patch candidate, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but DOES require user interaction (visiting a crafted page). Critically, the description states code execution occurs 'inside the sandbox' - meaning Scope is Unchanged (S:U, confirmed by vector), so a single exploit does not by itself escape to the host OS; full system compromise would require chaining a separate sandbox-escape bug. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or public exploit code at this time; exploitation status is 'no public exploit identified at time of analysis.' Google rates the Chromium severity as High. The combination of ubiquitous deployment and browser attack surface warrants prompt patching, but the required user interaction and sandbox containment temper the real-world risk relative to the raw 8.8 score. No conflicting signals were found, though the absence of EPSS/KEV data means exploitation likelihood cannot be quantified from the input alone.

An attacker hosts or compromises a web page containing malicious HTML crafted to trigger improper input validation in Chrome's Views component. A victim running an unpatched Chrome (prior to 156.0.8078.47) visits the page, and the attacker achieves arbitrary code execution within the renderer sandbox. No public proof-of-concept was identified in the provided data.