Google Chrome EUVD-2026-105518

Exploitation requires the victim to use an affected Chrome desktop build (prior to 156.0.8078.47) and to actively visit or render attacker-controlled content - the CVSS UI:R and the 'crafted HTML page' phrasing confirm user interaction is mandatory; this is not a zero-click or server-side flaw. No authentication is required (PR:N). The critical LIMITING factor is containment: the description states code executes 'inside the sandbox,' so the impact is confined to the Chrome renderer process unless combined with an independent sandbox-escape vulnerability. The flaw resides in the Extensions component, so exposure is tied to Chrome's normal extension-handling paths rather than a non-default setting.

Signals are mixed and point to moderate, not critical, real-world priority. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R) which looks high, but Google/Chromium themselves rated this 'Medium' severity, and the description is explicit that code execution is 'inside the sandbox' - Chrome's renderer sandbox is a strong containment boundary, so without a chained sandbox-escape this does not yield host compromise. This is a meaningful discrepancy: the C:H/I:H/A:H impact in the vector reflects full compromise of the sandboxed renderer process, not the underlying OS. EPSS is low (0.30%, 22nd percentile), it is NOT on CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active or imminent widespread exploitation. UI:R also means a victim must be lured to a crafted page. Net: a genuinely patch-worthy browser flaw given Chrome's ubiquity, but currently a routine 'patch in normal cycle' item rather than an emergency, and the 8.8 CVSS overstates practical impact relative to the sandbox-contained reality.

An attacker hosts a crafted HTML page (or compromises a site / serves a malicious ad) that abuses an improper input-validation flaw in Chrome's Extensions component when a victim using a vulnerable version (pre-156.0.8078.47) visits it. Successful exploitation runs attacker-controlled code within the Chrome renderer sandbox; the attacker would then typically need a separate sandbox-escape bug to reach the host OS. No public proof-of-concept was identified in the available data.