Google Chrome EUVD-2026-105586

Exploitation requires a victim running Google Chrome on Android at a version prior to 156.0.8078.47 to actively load attacker-controlled content, specifically a crafted HTML page that reaches the WebAppInstalls code path (UI:R). No authentication or special privileges are needed (PR:N, unauthenticated), and default configurations are affected, but the mandatory user interaction (visiting or rendering the malicious page) and the Android-only scope limit realistic exploitation; impact is further constrained to reading memory within the renderer sandbox, with no sandbox escape, write, or denial-of-service capability indicated.

Multiple signals converge on a genuinely low-to-moderate priority rather than an urgent emergency. The CVSS 3.1 vector (6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw, but one that requires user interaction (UI:R) and yields only confidentiality impact with no integrity or availability loss, consistent with the description's 'potentially read memory inside the sandbox.' Google itself rated the Chromium security severity as Medium, which aligns with a sandbox-bounded information leak rather than a sandbox escape or RCE. EPSS is low at 0.18 percent (8th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data, so there is no evidence of active exploitation. These signals are mutually consistent (low EPSS, Medium vendor severity, no KEV/POC), so this is a patch-in-normal-cadence issue, not a drop-everything priority. One caveat: CWE-119 and the 'memory corruption' wording could in principle be leveraged as a primitive in a chained exploit, and the CVSS C:H rating is somewhat generous for a bounded sandbox read, so treat C:H as an upper bound and verify the true data exposure with Google's advisory.

A remote attacker hosts a crafted HTML page and lures an Android Chrome user to visit it (UI:R). Rendering the page triggers the memory-corruption flaw in the WebAppInstalls component, letting the attacker read memory within the renderer sandbox and potentially leak sensitive in-process data. No public exploit code was identified at time of analysis, and the low complexity (AC:L) means a working trigger would be reliable once developed.