Google Chrome EUVD-2026-105458

Exploitation requires the victim to navigate to attacker-controlled web content: a crafted HTML page that abuses the Chrome FileSystem component's improper input validation (CWE-20). The limiting factor is the mandatory user interaction (UI:R) - the attack is not wormable or server-side and depends on the user opening or being redirected to the malicious page. A further significant limit is that successful exploitation yields code execution confined to the renderer sandbox (scope unchanged); escaping to the host requires chaining a separate sandbox-escape vulnerability. Affected scope is Chrome desktop builds prior to 156.0.8078.47 (with corresponding ChromeOS stable-channel updates); patched or auto-updated installations are not exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction - the victim must visit a crafted HTML page - which tempers the raw score. A critical qualifier from the description is that code execution occurs INSIDE the Chrome sandbox (scope unchanged, S:U), meaning this is not a full host compromise on its own and would typically need to be chained with a sandbox-escape bug to achieve persistent system-level RCE; the 8.8 score reflects in-sandbox impact, not host takeover. Chromium rates the security severity as High. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuine high-priority patch for a ubiquitously deployed browser because of its enormous attack surface and drive-by delivery model, but the user-interaction requirement and sandbox-confined impact mean it is a serious-but-not-emergency issue in the absence of a paired escape - prioritize via Chrome's auto-update rather than as a KEV-grade fire drill.

An attacker hosts or compromises a web page containing malicious HTML that abuses the FileSystem input-validation flaw, then lures a victim to visit it (e.g., via phishing link or malvertising). When the page loads in an unpatched Chrome build prior to 156.0.8078.47, the crafted content triggers the flaw and runs attacker-controlled code within the renderer sandbox. No public POC is referenced in the available data.