Google Chrome EUVD-2026-105516

Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to actively load attacker-controlled web content - the CVSS UI:R and the description's 'crafted HTML page' mean user interaction (navigating to or rendering the malicious page) is mandatory, so this is not a zero-click flaw. No authentication or special privileges are needed (PR:N). The key limiting factor is that resulting code execution is confined INSIDE the Chrome sandbox (S:U, 'inside the sandbox'): on its own this does not grant host/OS compromise and would need to be chained with a separate sandbox-escape bug for full system takeover, which materially reduces real-world impact.

Signals are mixed and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a classic drive-by profile. However, the vendor explicitly rates the Chromium security severity as Medium, and the description constrains impact to code execution INSIDE the renderer sandbox (not a full sandbox escape/host compromise), so the real-world impact is lower than the 8.8/C:H/I:H/A:H vector alone implies; the high CIA values reflect full compromise of the sandboxed process rather than the host. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. This is a genuine high-severity memory-corruption bug in an ubiquitous product and should be patched promptly through normal Chrome auto-update, but absent KEV/POC/EPSS signals it is not currently an emergency; treat it as a priority patch rather than an actively-exploited incident. Conflict to verify: CVSS base 8.8 (High) versus vendor Chromium severity 'Medium' - the divergence is explained by sandbox containment, so defenders should weight the vendor's Medium rating when prioritizing against non-sandboxed RCEs.

An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption condition (CWE-119) in Chrome's Browser/renderer code. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page and the attacker achieves arbitrary code execution within the Chrome sandbox. No public exploit was identified in the provided data, and successful exploitation requires user interaction (navigating to the malicious page).