Google Chrome EUVD-2026-105515

Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to visit or render attacker-controlled HTML content - this user-interaction requirement (UI:R) is the primary limiting factor, as the attack is not self-propagating and needs the target to load a malicious or compromised page. No authentication or special privileges are required (PR:N). Critically, successful exploitation grants code execution only within Chrome's renderer sandbox (per the description), so realistic host compromise additionally depends on chaining a separate sandbox-escape vulnerability; without that, impact is contained to the sandboxed process. No non-default configuration is required.

Signals are mixed and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a victim load a crafted HTML page - a classic browser drive-by profile with high technical impact. However, Google's own Chromium rating is only 'Medium', and the description explicitly scopes code execution to 'inside the sandbox,' meaning this bug alone yields renderer-process compromise rather than full host takeover; it would typically need to be chained with a separate sandbox-escape to be weaponized into a true RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or available exploit code at this time. Net assessment: patch promptly as part of normal Chrome update hygiene given the ubiquity and network attack surface, but this is not currently a drop-everything emergency - the Medium Chromium severity, sandbox-limited impact, and absence of exploitation signals argue against the 8.8 score overstating real-world urgency. Note the discrepancy explicitly: the CVSS base score (High/8.8) conflicts with the vendor's Medium severity, likely because CVSS does not model the sandbox containment.

An attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption bug in Chrome's Scroll component when a victim visits it. Successful exploitation lets the attacker run arbitrary code within the browser's sandboxed renderer process, which would then need to be combined with a sandbox escape to affect the underlying system. No public exploit code is identified at time of analysis.