Google Chrome EUVD-2026-105592

Exploitation requires a victim running Google Chrome on iOS at a version prior to 156.0.8078.47 to actively open or render an attacker-controlled crafted HTML page (UI:R - user interaction is mandatory; there is no zero-click vector here). No authentication is required (PR:N) and no special non-default configuration is needed - default Chrome-on-iOS installations are affected. The key LIMITING factors are: (1) mandatory user interaction (the victim must visit the malicious page), and (2) the resulting code execution is confined to the browser sandbox ('inside the sandbox'), so without a separate sandbox-escape the attacker does not gain full device or OS-level control.

This is a genuinely serious but not top-tier-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - the classic drive-by browser exploitation profile, scoring 8.8 (High). However, two signals pull the real-world priority down. First, the description explicitly states the arbitrary code execution occurs 'inside the sandbox,' and Google rated the Chromium security severity as only Medium - meaning this is renderer/sandbox-contained code execution, not a full device or OS compromise, and would typically need to be chained with a sandbox-escape to be fully weaponized. The CVSS 8.8 therefore overstates practical impact relative to Google's own Medium rating; the S:U (scope unchanged) in the vector is consistent with sandbox containment. Second, no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a real, patch-worthy memory-corruption bug worth prioritizing in normal browser-update cadence, but the sandbox containment and absence of exploitation signals make it a lower operational emergency than the raw 8.8 suggests. Note the conflict to verify: the numeric CVSS (High/8.8) versus the vendor's Medium Chromium severity rating.

An attacker hosts or compromises a web page containing specially crafted HTML that triggers the use-after-free in the iOSWeb component. A Chrome-on-iOS user is lured to the page (phishing link, malvertising, or compromised site), and merely rendering it corrupts freed memory, allowing the attacker to execute arbitrary code within the browser's sandbox. No public POC is referenced, and the resulting execution is sandbox-confined, so full device compromise would require an additional sandbox-escape chain.