Google Chrome EUVD-2026-105555

Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to load attacker-controlled crafted HTML (UI:R - user must visit/open the malicious page); no authentication or special configuration is needed against default Chrome installs. The key limiting factor is that resulting code execution is contained within the renderer sandbox per the vendor description, so standalone host compromise is not demonstrated and would require chaining an additional sandbox-escape vulnerability; auto-updating Chrome channels also shorten the exposure window once the stable update is applied.

Signals are moderately consistent but point to a patch-priority rather than emergency item. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 (High), reflecting network reach, low attack complexity, no privileges, and only user interaction (visiting a crafted page) as a gate. However, Google/Chromium rated the issue only 'Medium' severity, and the description is explicit that code execution occurs INSIDE the sandbox - i.e. no sandbox escape to the host is claimed - which materially lowers real-world impact versus what the C:H/I:H/A:H + 8.8 score implies. This CVSS-vs-vendor-severity divergence should be weighed: the 8.8 treats in-sandbox code execution as full confidentiality/integrity/availability compromise, while in practice a sandboxed renderer compromise typically requires chaining a second escape bug for host impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate patch-now item given Chrome's ubiquity and the low complexity, but not a confirmed-exploited crisis, and the headline 8.8 overstates standalone impact because exploitation is sandbox-contained.

An attacker hosts or compromises a web page containing crafted HTML that triggers the Core memory-corruption flaw when a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits it. Successful exploitation yields arbitrary code execution confined within the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape bug for host compromise. No public proof-of-concept was identified at time of analysis.