Google Chrome EUVD-2026-105573

Exploitation requires the victim to actively load attacker-controlled HTML in a vulnerable Chrome desktop build (any version prior to 156.0.8078.47) - consistent with UI:R, this needs user interaction (visiting a malicious or compromised page). No authentication or special privileges are required (PR:N). A key LIMITING factor: the description confines resulting code execution to 'inside the sandbox' (scope unchanged), so an attacker gains only renderer-level execution unless a separate sandbox-escape is chained. The flaw sits in the Extensions component; no non-default configuration is stated as required, so default installations with standard web rendering are affected.

Signals are mixed and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a classic drive-by profile for a browser. However, two factors temper this: Chromium itself rated the issue 'Medium' severity (not High/Critical), and the description explicitly scopes code execution to 'inside the sandbox' (S:U, scope unchanged), meaning a successful attacker gains execution in the constrained renderer process, not full host compromise, absent a separate sandbox-escape chain. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. The practical takeaway: this is a genuine browser memory-corruption bug worth patching promptly because Chrome is ubiquitous and user interaction is trivial to obtain, but it is not currently an emergency - the sandbox containment and absence of exploitation signals place it below actively-exploited renderer+escape chains. Note the CVSS base score (8.8, High) and Chromium's internal 'Medium' rating diverge; the CVSS impact metrics likely do not account for sandbox confinement, so treat 8.8 as an upper bound on real-world impact for an isolated bug.

An attacker hosts or compromises a web page containing malicious HTML that triggers memory corruption in Chrome's Extensions component when rendered. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page and the attacker achieves arbitrary code execution within the browser sandbox. No public exploit is identified at time of analysis, and full host compromise would require chaining an additional sandbox-escape vulnerability.