Google Chrome EUVD-2026-105502

Exploitation requires the victim to load attacker-controlled HTML that exercises the GetUserMedia (media capture) code path in a Chrome build older than 156.0.8078.47; the CVSS UI:R confirms required user interaction (visiting/opening the malicious page), which is the primary limiting factor. No authentication is required (PR:N) and the attack is network/web-delivered (AV:N) against default Chrome configurations, but impact is bounded to a memory read confined inside the renderer sandbox (S:U, C:H/I:N/A:N) - meaningful escalation would require chaining with a separate sandbox-escape vulnerability.

This is a genuine but low-priority medium-severity issue, and the multi-source signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) describes a remotely reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R - the victim must open a crafted page) and yields only confidentiality impact (C:H/I:N/A:N), i.e. an information leak with no code execution or integrity/availability effect. Chromium itself rated it Medium. The EPSS score of 0.18% (8th percentile) agrees with this low-to-moderate picture, indicating little likelihood of broad opportunistic exploitation. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. Critically, the description states the out-of-bounds read is 'inside the sandbox,' meaning on its own it leaks memory from within the renderer sandbox and would typically need to be chained with a sandbox-escape to be high-impact - a limiting factor the raw 6.5 score does not convey. Net: patch in the normal browser update cycle, not an emergency.

An attacker hosts or injects a malicious web page containing crafted media/getUserMedia content and lures a victim running a vulnerable Chrome build to visit it. When the page is rendered, the GetUserMedia code performs an out-of-bounds read, leaking adjacent renderer-sandbox memory back to attacker-controlled script, potentially exposing sensitive in-process data. No public proof-of-concept is referenced, and successful exploitation requires the user to actually open the attacker's page.