Google Chrome EUVD-2026-105450

Exploitation requires the victim to be running Google Chrome prior to 156.0.8078.47 on Windows and to actively navigate to an attacker-controlled or compromised web page containing crafted HTML that exercises the ANGLE component (UI:R user interaction is mandatory). No authentication or prior privileges are needed (PR:N). The key limiting factor is that the resulting arbitrary code execution is confined to the renderer sandbox (S:U, 'inside the sandbox' per the description) - achieving host compromise would require chaining an additional sandbox-escape vulnerability. Exploitation is also constrained to the Windows build of Chrome as stated.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page) and yields high confidentiality, integrity, and availability impact. A critical nuance: scope is Unchanged (S:U) and the description explicitly states code execution occurs 'inside the sandbox' - this is renderer-level code execution, NOT a confirmed sandbox escape or full host compromise, which materially lowers real-world impact versus a standalone 8.8 reading. No EPSS score, SSVC decision data, or POC indicator was provided, and the CVE is not listed in CISA KEV, so exploitation probability cannot be quantified from the input; no public exploit identified at time of analysis. Google rated the underlying Chromium issue 'High' (not Critical), consistent with a sandboxed-RCE primitive that typically needs a chained sandbox-escape bug to be fully weaponized. Net assessment: this is a legitimate patch-now browser vulnerability given Chrome's ubiquity and the Chromium issue tracker reference, but there is no evidence of active or imminent widespread exploitation, so it should be prioritized via normal rapid-browser-patch cadence rather than emergency incident response. Missing data: EPSS and SSVC are absent - do not infer exploitation likelihood.

An attacker hosts or compromises a web page containing crafted content that exercises Chrome's ANGLE graphics component; when a victim on Windows (Chrome prior to 156.0.8078.47) visits it, improper input validation in ANGLE is triggered, allowing arbitrary code execution within the renderer sandbox. No authentication is required (PR:N) but the victim must actively load the malicious page (UI:R). No public exploit code was identified in the provided data, and full system compromise would additionally require chaining a separate sandbox-escape vulnerability.