Google Chrome EUVD-2026-105524

Exploitation requires the victim to load a crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.47 (UI:R user interaction), with no authentication and no special browser configuration - it works against default installations. The key limiting factors are: (1) mandatory user interaction (the target must navigate to or render attacker-controlled content), and (2) code execution is contained within the Chrome renderer sandbox, so achieving host-level compromise requires chaining this bug with an additional sandbox-escape vulnerability. These constraints materially reduce standalone real-world impact despite the 8.8 CVSS score.

Signals are largely consistent and point to a genuine but bounded priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a remote, low-complexity, unauthenticated attack that needs only user interaction (visiting a page), which aligns well with the description of a crafted HTML page triggering a use-after-free. The 8.8 base score reflects full C/I/A impact, but a critical nuance limits real-world severity: the description explicitly states code execution occurs 'inside the sandbox' and the CVSS scope is Unchanged (S:U), meaning a successful exploit is confined to the Chrome renderer process and does NOT by itself compromise the host - full system takeover would require chaining with a separate sandbox-escape vulnerability. This is consistent with Google's own 'Chromium security severity: Medium' rating, which contrasts with the 8.8 (High) CVSS score; the discrepancy is explained by the sandbox containment rather than a scoring error. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis. Net assessment: patch promptly as part of normal Chrome update hygiene, but in the absence of exploitation evidence and given sandbox confinement, this is a routine browser-patch priority rather than an emergency.

An attacker hosts or compromises a web page containing malicious JavaScript/HTML that triggers the use-after-free in the Script engine. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, and the attacker gains arbitrary code execution within the renderer sandbox. Because the flaw is network-reachable with low complexity but requires the victim to visit the page (UI:R), delivery typically relies on phishing, malvertising, or a watering-hole site; no public exploit was identified at time of analysis.