Google Chrome EUVD-2026-105570

Exploitation requires the victim to open or render attacker-controlled HTML in a vulnerable Chrome build prior to 156.0.8078.47 (UI:R - user must visit/view the crafted page), and the use-after-free resides specifically in the Extensions component, so the code path backing extension handling must be exercised by the page. No authentication is required (PR:N). Key limiting factors: the resulting code execution is confined to the Chrome sandbox (S:U), so it does not by itself yield host-level compromise and would need to be chained with a sandbox-escape bug for full RCE; the victim must be induced to visit the page; and auto-updated Chrome installations on or after 156.0.8078.47 are not affected.

Multiple signals converge on this being a genuine high-priority patch item, with one notable caveat around the CVSS magnitude. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim view a crafted HTML page - the classic drive-by browser profile. However, the description explicitly limits code execution to 'inside the sandbox' (consistent with S:U, no scope change), meaning this is NOT a full sandbox escape or host compromise on its own; it would typically need to be chained with a separate sandbox-escape bug for attacker code to reach the underlying OS. Note the tension between signals: the NVD-style CVSS of 8.8 (HIGH) contrasts with Google's own 'Chromium security severity: Medium' rating, which reflects exactly that sandbox-containment limitation - treat 8.8 as the upper bound. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent mass exploitation; exploitation status is 'no public exploit identified at time of analysis.' Use-after-free (CWE-416) bugs in Chrome are historically exploitable and frequently weaponized over time, but UAF exploitation is non-trivial to develop reliably. Given Chrome's ubiquity, the recommended action is to prioritize patching promptly despite the absence of exploitation signals, because the install base is enormous and browser renderer UAFs are a favored target for chaining.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's Extensions component; a victim running a pre-156.0.8078.47 Chrome simply visits the page (UI:R). The freed object is reclaimed and manipulated to corrupt memory, letting the attacker execute arbitrary code within the renderer/sandbox process. No public exploit code is identified in the provided data, and achieving impact beyond the sandbox would require chaining a separate escape vulnerability.