Google Chrome EUVD-2026-105498

Exploitation requires the victim to load attacker-controlled crafted HTML in a vulnerable Google Chrome build prior to 156.0.8078.47, exercising the ServiceWorker code path - user interaction is mandatory (CVSS UI:R), so there is no silent/zero-click or server-side exposure. No authentication or special privileges are needed on the target (PR:N), and default Chrome configurations are affected since ServiceWorker is a standard web-platform feature. The primary limiting factor is that a user must be induced to visit a malicious or compromised page; patched builds (156.0.8078.47 and later) are not exploitable.

Conflicting severity signals dominate this assessment. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields a Critical 9.6, driven by network vector, no privileges, and a scope change reflecting the 'outside the sandbox' sandbox escape - yet Google's own Chromium rating is explicitly 'Medium', a notable discrepancy that should be reconciled with the vendor before treating the 9.6 as definitive. On real-world signals, there is no EPSS score provided, no CISA KEV listing, and no public POC in the input, so exploitation is 'no public exploit identified at time of analysis'. The single mitigating factor is UI:R - a victim must visit a crafted HTML page - which reduces this from wormable to drive-by/social-engineering territory. Because this is a browser sandbox escape in ubiquitous software with a patch already shipped, it is a genuine patch-now priority despite the absence of confirmed exploitation; browser memory-corruption bugs are routinely weaponized post-disclosure. Net: high priority on prevalence and impact, but current active-exploitation risk is unconfirmed and the vendor/NVD severity disagreement should be flagged to stakeholders.

An attacker hosts or compromises a web page containing crafted HTML that triggers the ServiceWorker memory-corruption flaw, then lures a victim to visit it via phishing, malvertising, or a watering-hole site. When the page loads in a vulnerable Chrome build (prior to 156.0.8078.47), the corruption is leveraged to execute arbitrary code outside the renderer sandbox. No public exploit code is identified in the provided data, so this scenario is inferred from the CVSS vector and description.