Google Chrome EUVD-2026-105441

A victim running Chrome prior to 156.0.8078.47 must load an attacker-controlled HTML page containing content crafted to trigger the V8 JavaScript engine use-after-free; no authentication or special configuration is required because V8 processes untrusted web content by default. Limiting factors: exploitation requires user interaction (UI:R) - the victim must navigate to the malicious page - and the resulting arbitrary code execution is confined to the renderer sandbox (scope unchanged, S:U), so a separate sandbox-escape vulnerability would be needed to compromise the underlying operating system.

CVSS 3.1 base score 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page, which aligns with the description of a V8 use-after-free (CWE-416) triggered via web content. A vendor patch is confirmed available (Chrome 156.0.8078.47). No EPSS probability was provided in the input, there is no CISA KEV listing, and no public POC was identified, so no observed or predicted exploitation signal is available to amplify or temper the CVSS reading. Two factors meaningfully constrain real-world risk despite the high score: (1) S:U (scope unchanged) and the vendor's explicit wording 'execute arbitrary code inside the sandbox' indicate code execution is confined to the renderer sandbox - this is NOT a confirmed full-system compromise and would require a separate sandbox-escape chain for host takeover; (2) UI:R means a user must be lured to attacker-controlled content. Net assessment: a genuine high-priority browser patch given Chrome's ubiquity and the ease of delivering malicious web content, but the absence of KEV/POC/EPSS signals and the sandbox-confined impact suggest it is not currently in the top-tier 'actively exploited emergency' category. Deploy the patch promptly on the normal browser update cadence.

An attacker hosts or compromises a web page containing JavaScript crafted to trigger the V8 use-after-free, then lures a victim to visit it via a phishing link or malvertising. When the victim's unpatched Chrome renders the page, the dangling pointer is reclaimed to achieve arbitrary code execution within the renderer sandbox. No public exploit code has been identified at the time of analysis, though the low attack complexity (AC:L) implies a reliable exploit once developed.