Google Chrome EUVD-2026-105566

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to actively load attacker-controlled web content that exercises the Animation component (the crafted HTML page), so required user interaction (UI:R) is the primary limiting factor - there is no drive-by without the user navigating to or being redirected to the malicious page. No authentication is required (PR:N). The decisive mitigating condition is architectural: resulting code execution is contained within the renderer sandbox, so host compromise is NOT achievable from this flaw alone and would require chaining an additional sandbox-escape vulnerability. Patched builds (156.0.8078.47 and later) are not affected.

Signals are moderately consistent but point to a lower real-world priority than the raw CVSS 8.8 suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated bug requiring user interaction (visiting a crafted page), and the C:H/I:H/A:H impact drives the 8.8 score. However, the description explicitly states code execution is 'inside the sandbox' with no sandbox escape, and Chromium itself rated the security severity only Medium - so the C/I/A:H values reflect full compromise of the renderer process, NOT the host, meaning the practical blast radius is a single sandboxed renderer absent a chained escape. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified, so there is currently no evidence of active or imminent exploitation. Net: this is a standard, patch-on-cycle browser memory-safety fix rather than an emergency; the 8.8 overstates urgency because the CVSS base metrics do not credit the sandbox containment that both the vendor and the Medium Chromium rating emphasize.

An attacker hosts or compromises a web page containing malicious JavaScript/HTML that drives Chrome's Animation subsystem into a use-after-free state. A victim running a pre-156.0.8078.47 build simply visits the page, and the attacker gains arbitrary code execution confined to the renderer sandbox. No public proof-of-concept was identified at the time of analysis, and reaching the host would require chaining a separate sandbox-escape vulnerability.