Google Chrome EUVD-2026-105562

Exploitation requires that a user of Chrome for Android on a version earlier than 156.0.8078.47 actively load attacker-controlled web content that exercises the Notifications component to trigger the use-after-free (UI:R - user interaction is mandatory). No authentication is required (PR:N) and no non-default configuration is indicated - the Notifications subsystem is a standard browser feature. The key limiting factors are: (1) mandatory victim interaction (visiting/rendering the malicious page), (2) the resulting code execution is confined to the renderer sandbox (S:U), so a separate sandbox-escape vulnerability is needed before host-level compromise is possible, and (3) only Android builds prior to 156.0.8078.47 are affected, so patched or auto-updated devices are not exploitable.

This is a genuine medium-to-high priority issue, though not an emergency on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a low-complexity, network-reachable, unauthenticated attack that requires only that the victim visit a crafted HTML page - a trivially satisfied condition for a web browser. The 8.8 base score with C:H/I:H/A:H is driven by arbitrary code execution, but a critical mitigating fact appears in the description and not in the raw score: execution is confined 'inside the sandbox' (consistent with S:U, Scope Unchanged), so this alone does not yield host compromise and would need to be chained with a sandbox-escape bug to become a full device takeover. Note the tension between signals: the raw CVSS is 8.8 (High) while Google's own Chromium severity rating is only 'Medium,' precisely because of the sandbox containment - defenders should weight the Chromium 'Medium' rating here. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing and no POC referenced. EPSS is not provided in the input, so exploitation-probability cannot be quantified; SSVC inputs (automatable, exploitation status) are likewise absent. Use-after-free in a browser is historically a heavily weaponized bug class, so the latent risk is real, but on the evidence provided this is a patch-on-normal-cadence item rather than a confirmed active threat.

An attacker hosts a malicious web page (or injects malicious content into a page/ad the victim already trusts) that abuses the Notifications component on Chrome for Android to trigger a use-after-free. When an Android user with a vulnerable Chrome build (before 156.0.8078.47) loads the page, the dangling pointer is exploited to run attacker-controlled code within the renderer sandbox, enabling theft of in-browser data and setting up a chain toward a sandbox escape. No public exploit or POC is referenced in the provided data.