Google Chrome EUVD-2026-105469

Exploitation requires the victim to open attacker-controlled web content: a crafted HTML page processed by Chrome's Focus handling triggers the out-of-bounds read (CVSS UI:R confirms required user interaction). Per the CVSS vector PR:N, exploitation is unauthenticated and remote against default Chrome configurations - no special feature or non-default setting is named in the description. Limiting factors: the victim must actively navigate to or load the malicious page, and the resulting code execution is explicitly confined to the renderer sandbox (S:U), so full system compromise requires an additional sandbox-escape vulnerability not described here. Affected builds are those prior to 156.0.8078.47.

This is a genuine high-priority patching target, though not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction (the victim must open a crafted HTML page). The impact claim is strong - arbitrary code execution - but the CVSS scope is Unchanged (S:U), consistent with the description's explicit note that execution is confined 'inside the sandbox,' meaning full host compromise requires a separate sandbox-escape chain not covered here. Signals partly conflict with the headline impact: the underlying weakness is CWE-125 (out-of-bounds read), which typically yields information disclosure rather than direct code execution, so the stated RCE likely depends on favorable memory conditions or chaining - verify the exact exploitation primitive with Google/Chromium. No EPSS score, KEV listing, or public POC is present in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. Chromium's own rating is 'High' (not Critical). Net: a reliably patchable browser memory-safety bug in an ubiquitous product - update promptly, but absent KEV/POC/EPSS data this is not confirmed to be under active attack.

An attacker hosts or injects a crafted HTML page (via a malicious site, compromised ad, or link) and lures a user running a vulnerable Chrome build to open it. The page triggers the out-of-bounds read in the Focus component, allowing the attacker to leak adjacent memory and potentially execute code within the renderer sandbox. No public exploit code is identified at time of analysis, and the stated code-execution outcome remains confined to the sandbox.