Google Chrome EUVD-2026-105505

Exploitation requires the victim to visit or load an attacker-controlled crafted HTML page in a vulnerable Chrome build prior to 156.0.8078.47 (UI:R - user interaction via navigation/content rendering is required; no authentication needed per PR:N). The trigger is specific to ServiceWorker object lifecycle handling, so the attack path depends on content that registers or manipulates a ServiceWorker. A critical LIMITING factor: the description states code executes 'inside the sandbox,' so the attacker gains control only of the renderer process - translating this into host/system compromise requires chaining an additional sandbox-escape vulnerability. This materially reduces real-world impact versus the 8.8 score and matches the vendor's 'Medium' rating.

This is a genuine patch-priority issue but with an important nuance that raw CVSS obscures. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity, unauthenticated code execution - however, the description explicitly states code executes 'inside the sandbox,' meaning a full system compromise requires chaining a separate sandbox-escape vulnerability. Chromium's own vendor rating is only 'Medium,' which conflicts with the 8.8 NVD-style score and reflects this containment. No EPSS score, KEV listing, or public POC was provided in the input: exploitation status is therefore 'no public exploit identified at time of analysis.' UAF (CWE-416) bugs in Chrome's ServiceWorker are historically exploitable and frequently chained, so despite the absence of exploitation signals the enormous install base and network attack vector make prompt patching warranted. Net assessment: real priority for patch management given Chrome's ubiquity, but not an emergency - the sandbox boundary and lack of any active-exploitation or POC evidence argue against widespread immediate weaponization rather than this being a trivially remote full-system RCE.

An attacker hosts a malicious web page (or injects malicious content via an ad/iframe on a compromised site) that manipulates ServiceWorker lifecycle objects to trigger a use-after-free. A victim running a vulnerable Chrome build simply visits the page (UI:R), and the attacker achieves arbitrary code execution within the renderer sandbox. No public exploit was identified at time of analysis; full host compromise would require pairing this with a separate sandbox escape.