Google Chrome EUVD-2026-105514

Exploitation requires the victim to open an attacker-crafted HTML page in a vulnerable Chrome build (before 156.0.8078.47) that exercises the WebShare API - this user interaction (UI:R) is the primary limiting factor, as the attack cannot be triggered without the user visiting malicious content. No authentication is required (PR:N) and the attack is network-delivered (AV:N) against default Chrome installations. A critical limiting factor is sandbox containment: arbitrary code executes only inside the renderer sandbox, so real-world host compromise additionally depends on chaining a separate sandbox-escape vulnerability, which is not part of this CVE.

Multiple signals must be weighed carefully here. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a classic drive-by browser profile. However, this directly conflicts with two tempering facts: (1) Google/Chromium rated the issue 'Medium' severity, and (2) the description explicitly states code executes 'inside the sandbox,' meaning the renderer sandbox still contains the attacker and a separate sandbox-escape chain would be needed for full host compromise. This is why scope is unchanged (S:U) - the 8.8 reflects full impact within the sandboxed renderer process, not system-level takeover. EPSS, KEV, and POC data were all absent from the input: there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not a confirmed active-exploitation priority. The 'RCE' tag is accurate but should be read as sandboxed-renderer RCE, not unrestricted host RCE. Net: a legitimately patch-worthy memory/validation flaw in a ubiquitously deployed browser, but the sandbox containment and absence of exploitation evidence place it below actively-exploited Chrome zero-days in urgency. Prioritize via normal Chrome patch cadence.

An attacker hosts or compromises a web page containing malicious HTML that abuses the WebShare API's improper input validation. A victim running an unpatched Chrome (before 156.0.8078.47) visits the page, triggering the flaw and allowing the attacker to execute arbitrary code within the renderer sandbox. No public proof-of-concept was identified in the provided data; exploitation requires the user to visit the attacker-controlled page (UI:R), and the resulting code execution remains confined to the sandbox absent an additional escape.