Google Chrome EUVD-2026-105584

Exploitation requires the victim to use a Chrome desktop build prior to 156.0.8078.47 and to actively visit or load an attacker-controlled crafted HTML page (UI:R), making user interaction the primary limiting factor - there is no drive-by-without-navigation vector indicated. The flaw resides specifically in Chrome's Permissions handling and manifests as improper input validation; successful exploitation chains to code execution outside the sandbox. No authentication is required (PR:N), and no non-default configuration is named in the description, so default Chrome installations on the affected versions are in scope. The main constraints on real-world exploitation are the need for user navigation to malicious content and the up-to-date patch status of the target.

Signals are mixed and warrant careful interpretation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6 Critical, driven by network reach, low complexity, no privileges, and a scope change reflecting a sandbox escape with full confidentiality/integrity/availability impact. However, the only required interaction is a user visiting a crafted HTML page (UI:R), and Google's own Chromium security team rated this 'Medium' severity - a notable discrepancy between the calculated CVSS score and the vendor's internal triage, suggesting the practical exploitability or impact may be more constrained than 9.6 implies. No EPSS score, CISA KEV listing, SSVC decision data, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: patch promptly because Chrome is ubiquitous and sandbox escapes are serious, but the absence of exploitation signals plus the vendor's Medium rating means this is likely a priority-to-patch-in-cycle issue rather than an emergency zero-day; treat the 9.6 as a theoretical upper bound pending real-world exploitation evidence.

A remote attacker hosts or compromises a web page containing crafted content that abuses improper input validation in Chrome's Permissions component. When a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the flaw can be leveraged to execute code outside the renderer sandbox. No public proof-of-concept is identified in the available data, and the attack requires the user to navigate to the malicious page.