Google Chrome EUVD-2026-105487

Exploitation requires the victim to navigate to attacker-controlled or compromised web content served to a vulnerable Chrome build (prior to 156.0.8078.47) - this is the UI:R user-interaction prerequisite and the primary limiting factor, as no exploitation occurs without the user loading the malicious page. No authentication or special configuration is needed (PR:N), and default Chrome installations are affected. Impact is further limited by Chrome's renderer sandbox: the described code execution occurs 'inside the sandbox,' so a full host compromise would additionally require a separate sandbox-escape vulnerability. Auto-update normally delivers the fix, so the realistic exposure window is confined to clients with delayed or disabled updates.

Signals are moderately consistent but incomplete. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (victim must load a crafted page) with high impact to confidentiality, integrity and availability - note that this 8.8 contrasts with Chromium's own 'Medium' severity rating, a common divergence driven by NVD scoring code execution impact generously. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization; the realistic signal is 'patch available, no public exploit identified.' The CWE-125 (out-of-bounds read) classification is important: OOB reads more naturally yield information disclosure (e.g., sandbox memory leaks, ASLR bypass) than reliable arbitrary code execution, and the description hedges with 'potentially execute arbitrary code inside the sandbox' - meaning any resulting code execution is confined to the renderer sandbox and would still require a separate sandbox-escape to fully compromise the host. Priority is driven almost entirely by prevalence (Chrome is everywhere) rather than by confirmed exploitation. Treat as a standard high-priority browser patch: broad attack surface and trivial complexity, but mitigated by required user interaction, sandbox containment, and absence of any exploitation evidence.

An attacker hosts or compromises a web page containing crafted HTML that triggers the out-of-bounds read in Chrome's Navigation component when a victim browses to it. Successful exploitation could leak adjacent memory or potentially execute code within the renderer sandbox, though escaping the sandbox would require chaining an additional vulnerability. No public exploit code is identified at time of analysis, so this remains a theoretical/vendor-reported scenario.