Google Chrome EUVD-2026-105462

Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to load an attacker-controlled or attacker-influenced HTML page that exercises the WebAppInstalls feature (UI:R user interaction is the primary limiting factor - the user must navigate to or render the malicious page). No authentication or elevated privileges are needed (PR:N). The critical scope limitation is that successful code execution is confined to the browser renderer sandbox (S:U); without an additional sandbox-escape vulnerability, the attacker does not gain code execution on the underlying Android OS. The bug is memory-corruption based (use-after-free), so reliability may depend on heap-grooming conditions, though CVSS rates complexity as low (AC:L).

This is a genuine, actionable priority rather than a paper-tiger high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remotely reachable, low-complexity, unauthenticated memory-corruption bug (CWE-416 use-after-free) that only requires a victim to load a crafted HTML page - a routine action for a web browser, making UI:R a weak mitigating factor. Google/Chromium rated it security severity High and a vendor patch is available, which are the strongest confirmed signals here. Countervailing the raw score: the description explicitly states code execution occurs 'inside the sandbox' (S:U, no scope change), so this is NOT by itself a full device-takeover primitive - it would typically need to be chained with a sandbox-escape bug to be fully weaponized, which lowers standalone real-world impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation probability cannot be quantified from the input; absence of KEV means there is no evidence of active exploitation at time of analysis. Net: patch promptly (browser UAF bugs are historically favored exploitation targets and Chrome's footprint is enormous), but note the sandbox-contained scope tempers the single-bug severity.

An attacker hosts or injects a malicious HTML page (e.g., via a link, ad, or compromised site) that abuses the WebAppInstalls component to trigger a use-after-free when an Android Chrome user simply visits it. Exploiting the dangling pointer, the attacker achieves arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided data, and low attack complexity (AC:L) means a reliable exploit, once developed, would work against default configurations.