Google Chrome EUVD-2026-105467

Exploitation requires the victim to navigate to attacker-controlled crafted HTML content in Chrome prior to 156.0.8078.47 (UI:R / user interaction is mandatory), but needs no authentication and no special or non-default configuration - any standard Chrome install processing a malicious page through its normal Navigation handling is exposed. The key limiting factor is that code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so a full host compromise additionally requires a separate sandbox-escape vulnerability; the user-interaction requirement also rules out fully automated, zero-click mass exploitation.

This is a genuine patch-priority issue for any organization running Chrome, though signals are mixed on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a user visit a crafted page - a very common and realistic trigger for a browser. The use-after-free in the Navigation component (CWE-416) yields arbitrary code execution, but the description explicitly scopes this to 'inside the sandbox' (S:U, no scope change), meaning an attacker still needs a separate sandbox-escape to achieve full host compromise - this materially limits real-world impact compared to a chained full RCE. On exploitation likelihood: no EPSS score was provided in the input, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation or weaponization yet. The tension to note explicitly: Chromium-rated 'High' severity memory-corruption bugs are frequently targeted and sometimes exploited shortly after disclosure, so the absence of KEV/POC signals reflects current intelligence, not durable safety. Bottom line - prioritize patching due to ubiquity and low attack complexity, but recognize the sandboxed scope and lack of confirmed exploitation temper this below a 'drop-everything' emergency.

An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Navigation logic when a victim browses to it. Exploiting the freed object allows the attacker to execute arbitrary code within the renderer sandbox; a successful chain with a separate sandbox escape would be required for full host takeover. No public exploit code is referenced at time of analysis, and the attack requires user interaction (visiting the page).