Google Chrome EUVD-2026-105439

Exploitation requires a Windows user running Google Chrome prior to 156.0.8078.47 to load an attacker-crafted HTML page that drives the vulnerable ANGLE graphics code path (UI:R in the vector). ANGLE is Chrome's default graphics backend, so no non-default configuration is needed - default installations are affected. The principal limiting factors are the mandatory user interaction (victim must open the malicious page) and the platform restriction to Windows; no authentication or elevated privileges are required (PR:N).

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 9.6 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated flaw in ANGLE (Chrome's graphics abstraction layer) that escapes the renderer sandbox - the scope change (S:C) reflects code execution 'outside the sandbox,' which is the most severe class of browser bug. The only brake on the vector is UI:R: a victim must open attacker-controlled content. Exploitation signals are weaker than the severity: no EPSS score, no CISA KEV listing, and no public POC were provided, so the correct exploitation status is 'no public exploit identified at time of analysis.' Note the apparent tension - a sandbox-escape RCE in a ubiquitous browser is exactly the bug class that gets weaponized quickly, yet nothing in the supplied data confirms active exploitation; absence of EPSS/KEV/POC here is missing data, not evidence of safety. Google rating it 'High' (not 'Critical') internally is consistent with a renderer-to-host chain that still requires a crafted page. Given the universal Chrome install base and a working vendor patch, prioritize rapid patching.

An attacker hosts or compromises a web page containing crafted HTML/WebGL content that reaches the vulnerable ANGLE code path, then lures a Windows Chrome user to visit it (e.g., via phishing or a malicious ad). Because the flaw allows code execution outside the renderer sandbox, successful exploitation can run arbitrary code on the host with the browser's privileges. No public exploit code was identified in the provided data, but the low attack complexity makes reliable exploitation plausible once a technique is developed.