Google Chrome EUVD-2026-105470

Exploitation requires the victim to use an affected Google Chrome build (any version prior to 156.0.8078.47 on desktop/ChromeOS) and to actively load attacker-controlled HTML in that browser - the CVSS UI:R and the phrase 'via a crafted HTML page' confirm user interaction (navigating to a malicious or compromised page, or rendering malicious embedded content such as an ad/iframe) is mandatory. No authentication or special configuration is needed (PR:N; exploitable against default Chrome settings). The principal limiting factor is that code execution is confined to the renderer sandbox (S:U, 'inside the sandbox') - a successful attack does not by itself compromise the host OS and would need to be chained with a separate sandbox-escape vulnerability for full system control.

This is a genuine, high-priority patch item despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remote, low-complexity, unauthenticated memory-corruption flaw (CWE-416 use-after-free) reachable simply by rendering attacker-controlled HTML, with the only gating factor being user interaction (visiting a page). The signals are internally consistent - network vector matches the 'crafted HTML page' delivery, and S:U is correct because the description explicitly scopes code execution to 'inside the sandbox' rather than a full host escape. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation - the exploitation status is 'no public exploit identified at time of analysis.' However, browser-renderer UAFs of this class are historically high-value targets that are frequently chained and sometimes added to KEV after disclosure, so low current-exploitation signals should not be read as low future risk. Weighing against the raw score: the S:U scope and the explicit 'inside the sandbox' wording mean a successful exploit yields renderer-level code execution only - full system compromise would require a separate sandbox-escape bug, which materially limits standalone impact.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a page the victim trusts) that triggers the use-after-free in the Turbolev component when the victim's Chrome browser renders it. On a vulnerable version prior to 156.0.8078.47, this corrupts memory and lets the attacker run arbitrary code within the renderer sandbox. No public exploit code is identified at the time of analysis, and the attack still requires the victim to actively visit the page (UI:R).