Google Chrome EUVD-2026-105477

Exploitation requires the victim to use an affected Google Chrome build on iOS (any version before 156.0.8078.47) and to navigate to attacker-controlled content - the UI:R metric means the attack cannot fire without the user loading a crafted HTML page, which is the primary limiting factor. No authentication or special privileges are needed (PR:N), and no non-default configuration is called out in the advisory, so default Chrome-for-iOS installs are exposed. The decisive mitigating factor beyond user interaction is that resulting code execution is explicitly confined to the browser sandbox (S:U), so real-world device compromise additionally depends on a separate, unprovided sandbox-escape vulnerability.

Signals are mixed and warrant careful prioritization. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a victim load a crafted HTML page - a classic drive-by browser profile. However, this directly conflicts with Google's own Chromium severity rating of 'Medium', and critically the description states code execution occurs INSIDE the renderer sandbox, meaning a successful exploit is contained and does NOT by itself yield host compromise - a single sandbox-confined memory-corruption bug is materially lower real-world risk than the 8.8 score implies and would normally require chaining with a separate sandbox-escape to be fully weaponized. No EPSS score, no SSVC decision, no KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; per rules this is 'no public exploit identified at time of analysis.' Net assessment: a credible but not emergency-tier browser bug - patch on normal browser-update cadence rather than treating as a KEV-grade fire drill, while noting the CVSS/vendor-severity disagreement should be verified against Google's advisory.

A remote attacker hosts or compromises a web page containing malformed content that triggers the memory-corruption condition in Chrome's Navigation component; a victim running a vulnerable Chrome build on iOS simply browses to the page (satisfying the UI:R requirement). Successful exploitation corrupts memory and may allow arbitrary code execution, but execution is confined to the browser sandbox, so a further sandbox-escape would be needed for full device compromise. No public proof-of-concept was identified in the provided data.