Google Chrome EUVD-2026-105588

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build (any version prior to 156.0.8078.47) and be running the Extensions component code path that contains the out-of-bounds read; no authentication or elevated privileges are needed (PR:N). The principal limiting factor is mandatory user interaction (UI:R) - the attacker cannot trigger this without the user navigating to or rendering attacker-controlled content. Impact is further bounded by the Chromium sandbox: the description states the read is limited to memory inside the sandbox, so this yields information disclosure rather than code execution or host compromise, and provides no integrity or availability effect (I:N/A:N).

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must load attacker-controlled content - and is confidentiality-only with no integrity or availability impact. Chromium itself rated the severity Medium, consistent with the fact that the out-of-bounds read is confined to memory inside the renderer sandbox per the description, which caps real-world impact (it is a memory-disclosure/info-leak primitive, not direct code execution or a sandbox escape). The exploitation signals reinforce low operational urgency: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. There is no SSVC decision record in the provided data. Note one tension to verify: the CVSS assigns C:H, but the description scopes the leak to 'memory inside the sandbox,' suggesting the practical confidentiality impact may be lower than a High rating implies (a sandboxed read often yields fragments usable for ASLR-defeat/chaining rather than wholesale secret theft) - treat C:H as the vendor-consistent upper bound. Overall: a legitimate browser memory-disclosure bug in ubiquitous software, worth patching on the normal cycle, but it shows none of the mass-exploitation indicators (no KEV, low EPSS, no POC) that would make it an emergency.

An attacker hosts or compromises a web page containing a crafted HTML payload that triggers the out-of-bounds read in the Extensions component. When a victim using an unpatched Chrome (before 156.0.8078.47) visits the page, the attacker reads adjacent renderer/sandbox memory, potentially leaking sensitive values or pointers useful for defeating ASLR in a larger exploit chain. No public exploit code was identified at time of analysis, and successful exploitation depends on the victim loading the malicious page.