Google Chrome EUVD-2026-105496

Exploitation requires the victim to load attacker-controlled HTML content in Chrome (UI:R) - delivered via a malicious website, malvertising, or injected content - against any Chrome build prior to 156.0.8078.47 on default configurations; no authentication, privileges, or non-default settings are needed. The primary LIMITING factor is that resulting code execution is confined to the renderer sandbox (Scope:Unchanged), so full host compromise requires chaining an additional sandbox-escape vulnerability. User interaction (visiting the page) is a further limiter versus a zero-click flaw.

This is a genuine priority for any Chrome-dependent environment, though with important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the classic browser drive-by profile - and the 8.8 score reflects high confidentiality, integrity, and availability impact. However, two signals temper the raw score: Chromium's own triage rated this 'Medium' severity, and the description explicitly states code execution occurs 'inside the sandbox' (Scope:Unchanged), meaning this is NOT a confirmed sandbox escape and would need to be chained with a separate sandbox-escape bug to achieve full host compromise. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public POC referenced, so exploitation status is: no public exploit identified at time of analysis. The disparity between the high CVSS (8.8) and Chromium's Medium rating is the key tension - the vendor rating accounts for the sandbox containment that CVSS Scope:U partially reflects but which the overall score still treats as critical-adjacent.

A remote attacker hosts a malicious web page (or injects malicious content into an ad or compromised site) that triggers the SiteIsolation memory-corruption bug when a victim's Chrome browser renders it. Exploitation requires user interaction (UI:R) - the victim must visit the page - but no authentication or special privileges. Successful exploitation yields arbitrary code execution confined to the renderer sandbox; no public proof-of-concept exploit was identified at time of analysis.