Google Chrome EUVD-2026-105529

Exploitation requires the victim to open an attacker-controlled crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47), consistent with UI:R in the CVSS vector - there is no fully automatic/zero-click path in the provided data. The flaw is in Chrome's Bluetooth component, so it is reachable through web content handling. The key LIMITING factor is that resulting code execution is confined to the browser sandbox per the description; converting this into host-level compromise requires chaining an additional sandbox-escape vulnerability, which is not covered by this CVE. No authentication is required (PR:N).

Multiple signals point in conflicting directions here. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted page - which on its face looks high-priority. However, the Chromium security team rated this only 'Medium', and the description explicitly states code execution occurs 'inside the sandbox.' That containment is material: sandboxed renderer-process code execution does NOT by itself yield host compromise and would need to be chained with a separate sandbox-escape to become a full RCE. The CVSS 8.8 therefore likely OVERSTATES real-world impact relative to Chromium's own Medium rating - the C:H/I:H/A:H values reflect renderer-process impact, not the underlying OS. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no evidence of exploitation probability or public exploit code; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: patch on the normal Chrome update cadence (a vendor fix exists), but this is more of a routine high-CVSS-but-moderate-real-risk browser memory-safety bug than an emergency, given sandbox containment and absence of exploitation signals.

An attacker hosts or injects a malicious HTML page that drives the Chrome Bluetooth implementation into a memory-corruption condition when a victim with a vulnerable Chrome (<156.0.8078.47) visits it. Successful exploitation yields arbitrary code execution confined to the browser sandbox, which would then need to be combined with a sandbox escape to affect the host. No public exploit code was identified in the provided data.