Google Chrome EUVD-2026-105585

Exploitation requires the victim to navigate to or load attacker-controlled HTML in Chrome prior to 156.0.8078.47 (UI:R) - no authentication and no special browser configuration is needed, matching default Chrome installations. The primary limiting factor is that the resulting arbitrary code execution is confined to the renderer sandbox per the vendor description; achieving full system compromise would require chaining an additional sandbox-escape vulnerability. User interaction (visiting a page) is the only gating condition.

This is a genuinely high-priority patch target despite the vendor's 'Medium' Chromium severity label, which reflects internal triage rather than external impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page - a trivially met condition for a web browser. CWE-416 (use-after-free) in the 'Core' component is a classic memory-corruption primitive that mature exploitation toolchains routinely weaponize. However, the signals conflict in one important way: the description states code execution occurs 'inside the sandbox,' meaning this flaw alone does NOT achieve full host compromise and would need to be chained with a separate sandbox-escape to be fully weaponized - the CVSS C:H/I:H/A:H scoring does not capture this containment. On exploitation likelihood, EPSS is not provided and the CVE is NOT in CISA KEV and has no public exploit identified, so there is no evidence of active exploitation at time of analysis; the risk is driven by the ubiquity of Chrome and the historically high exploitability of UAF bugs, not by observed in-the-wild activity. Net: patch promptly because of deployment scale and bug class, but treat 'arbitrary code inside the sandbox' as a constrained impact pending a chained escape.

A remote attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's Core component; a victim need only visit the page (UI:R - user interaction via navigation). Successful exploitation yields arbitrary code execution confined within the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape for full host compromise. No public exploit identified at time of analysis.