Google Chrome EUVD-2026-105575

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) - i.e., user interaction (UI:R) is the primary limiting factor; the attacker needs no authentication or prior access (PR:N). The flaw resides in the Extensions component and affects default desktop Chrome installations, so no special non-default configuration is indicated. Critically, successful code execution is confined to the renderer sandbox per the vendor description ('inside the sandbox'), so full host compromise requires an additional, separate sandbox-escape vulnerability - this is the key factor limiting real-world impact of this bug in isolation.

This is a serious issue warranting prompt patching, though signals are mixed. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects remote, unauthenticated exploitation with only user interaction required and full C:H/I:H/A:H impact, which is the standard scoring Google applies to Chrome renderer memory-corruption bugs. However, two factors temper the raw score: the description explicitly states code execution occurs 'inside the sandbox' (scope S:U), meaning a successful exploit is confined to the renderer sandbox and would require a separate sandbox-escape chain to achieve full host compromise - so the C:H/I:H/A:H rating likely reflects worst-case renderer-context impact rather than host takeover. Additionally, Chromium rated this security severity 'Medium,' which is lower than the 8.8 NVD-style base score might imply. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified, so there is no evidence of active exploitation or weaponization at time of analysis. Net assessment: a credible, high-value browser RCE primitive (use-after-free in Extensions) that should be patched quickly given Chrome's ubiquity, but current exploitation-probability signals are absent/low and the sandbox-confined nature limits immediate standalone impact. Verify EPSS and monitor for POC emergence.

A remote attacker crafts a malicious HTML page that triggers the use-after-free in Chrome's Extensions component and lures a victim into visiting it (or compromises a site/ad the victim loads). When rendered, the freed object is reused to corrupt memory and execute attacker-controlled code within the browser's renderer sandbox. No public exploit code was identified at time of analysis, and successful host compromise would additionally require chaining a sandbox escape.