Google Chrome EUVD-2026-105452

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to visit a crafted HTML/JavaScript page that the attacker controls or has injected into (e.g., via malvertising or a compromised site) - this user interaction (UI:R) is the primary limiting factor. No authentication and no special privileges are required (PR:N), and no non-default configuration is needed; any default Chrome install in the vulnerable version range running JavaScript is exposed. Because the flaw escapes the sandbox (S:C), successful exploitation yields code execution on the underlying host rather than being contained to the renderer. The main realistic brake on exploitation is the need to drive the target to attacker-controlled content and the fact that patched/auto-updated browsers are not affected.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) is strongly corroborated by the description: a use-after-free (CWE-416) in the V8 JavaScript engine that, per Google, allows code execution OUTSIDE the Chrome sandbox - the scope change (S:C) accurately reflects that sandbox escape. Attack vector is network, complexity low, no privileges needed, with the only gating factor being user interaction (UI:R) - the victim must open a crafted HTML page. Key signals are MISSING rather than conflicting: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so active exploitation cannot be asserted. Historically V8 UAF sandbox-escape bugs are prime targets for exploit developers and in-the-wild n-day attacks once a patch ships, so the absence of a KEV entry likely reflects timing (freshly patched, Oct 2026) rather than low interest. Net: treat as urgent patch priority given the ubiquity of Chrome and the memory-corruption RCE class, while explicitly noting exploitation evidence is not yet confirmed by CISA or a published POC.

An attacker hosts or compromises a web page containing malicious JavaScript that triggers the use-after-free in V8's object handling. When a victim running a pre-156.0.8078.47 Chrome visits the page, the freed-object reuse corrupts memory, letting the attacker execute arbitrary code that escapes the renderer sandbox onto the host. No public exploit code is identified in the provided data, but the bug class is highly exploitable and user interaction is limited to a single page visit.