Google Chrome EUVD-2026-105443

Exploitation requires a victim running Google Chrome on Android at a version below 156.0.8078.47 to load a crafted HTML page that drives the vulnerable ANGLE graphics/translation layer (e.g., via WebGL/GPU rendering content). No authentication or special privileges are needed (PR:N), and it works against default Chrome configurations, but it is LIMITED by mandatory user interaction (UI:R) - the victim must navigate to or open the malicious page - and by the sandbox: successful exploitation yields code execution only within the renderer sandbox, so meaningful device-level impact requires chaining an additional sandbox-escape vulnerability. Chrome's automatic update mechanism also narrows the exposure window once the patched build propagates.

This is a credible high-priority browser vulnerability, though not an emergency at the time of analysis. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a realistic condition for a web browser. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public exploit was referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope is Unchanged (S:U) and the description explicitly limits the outcome to code execution 'inside the sandbox,' meaning this is a renderer-level memory-corruption bug (CWE-119, ANGLE graphics layer) that, by itself, does NOT constitute a full host compromise - it would typically need to be chained with a sandbox-escape bug to achieve device takeover. The C:H/I:H/A:H ratings reflect full compromise of the sandboxed renderer context, not the underlying OS. Net: real priority for patch management because Chrome is ubiquitous and the attack vector is trivial (visit a page), but the sandbox containment and absence of KEV/POC/EPSS signals argue against treating it as an imminent, in-the-wild threat. Note: EPSS data is missing entirely, so exploitation-probability cannot be quantified - rely on the Chrome auto-update cadence and vendor severity (High) instead.

An attacker hosts or compromises a web page containing specially crafted content that triggers the ANGLE memory-corruption bug when rendered by Chrome on Android. A victim is lured (phishing link, malvertising, or compromised site) into opening the page, and the memory corruption is leveraged to execute attacker-controlled code within the browser's sandboxed renderer process. No public exploit code was referenced, and exploitation requires user interaction (UI:R) to load the malicious page; full device compromise would additionally require a separate sandbox escape.