Google Chrome EUVD-2026-105485

Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to actively visit or render attacker-controlled crafted HTML (CVSS UI:R), so a user-interaction step gates the attack - there is no fully automatic, no-click path. No authentication is required (PR:N) and the attacker needs no prior access to the target. The key limiting factor is sandbox containment: the description states code executes 'inside the sandbox' with scope unchanged (S:U), so a successful trigger alone does not compromise the host OS or other sites' data without an additional sandbox-escape vulnerability. Users on auto-updating Chrome channels who have already received 156.0.8078.47 or later are not exploitable.

Signals are largely consistent and point to a genuine, patch-worthy browser flaw of moderate real-world severity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated bug that requires user interaction (visiting a crafted HTML page). However, the description explicitly limits code execution to 'inside the sandbox' and the vector keeps S:U (scope unchanged) - meaning this is NOT a confirmed sandbox escape, so the practical impact is bounded by Chrome's renderer/extensions sandbox unless chained with a second escape bug. Google/Chromium rated the security severity only 'Medium', which tempers the 8.8 CVSS High rating and reflects the sandbox-contained impact. No EPSS score, no SSVC decision, no KEV listing, and no public POC are present in the input, so there is no evidence of active or imminent exploitation. Net: a legitimate patch-now item for browser fleets given Chrome's ubiquity and the low exploitation complexity, but not an emergency - the absence of KEV/POC and the sandbox containment argue against treating it as actively weaponized. Note the signal tension: CVSS High (8.8) vs. vendor 'Medium' severity - the discrepancy is explained by sandbox containment, not a data error.

An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's Extensions component when a victim with a vulnerable Chrome build (prior to 156.0.8078.47) visits it. The freed-then-reused memory is manipulated to achieve arbitrary code execution within the browser sandbox. No public exploit code was identified at time of analysis, and real-world damage would typically require chaining a separate sandbox-escape to affect the host.