Google Chrome EUVD-2026-105599

Exploitation requires the victim to use an affected Google Chrome build prior to 156.0.8078.47 and to load attacker-controlled web content (UI:R) - no authentication or prior privileges are needed (PR:N). The defining limiting factor is that successful code execution is confined to the renderer SANDBOX (scope Unchanged); to escape the sandbox and compromise the host, an attacker must chain this with a separate sandbox-escape vulnerability. No special victim-side configuration is required, so default Chrome installations rendering the malicious page are exposed, but the attack cannot succeed without user navigation to the crafted page.

Signals are mostly aligned toward a genuine but bounded priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a remote, unauthenticated, low-complexity attack that only requires a victim to load a crafted HTML page - a realistic drive-by condition for a browser. However, the most important mitigating signal is embedded in the description itself: code execution is 'inside the sandbox' and the CVSS scope is Unchanged (S:U), so a successful exploit is contained to the renderer sandbox and would require a separate sandbox-escape chain to achieve full host compromise. This is consistent with Chromium's own 'Medium' severity rating, which is notably LOWER than the aggregate CVSS of 8.8 - a conflict worth flagging: the 8.8 reflects full C/I/A loss within the renderer, while Google's Medium rating reflects the sandbox containment that limits real-world blast radius. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no POC is referenced, so this is not confirmed active exploitation. No SSVC decision data was supplied. Net: a credible memory-corruption flaw in a ubiquitously-deployed product that should be patched promptly via normal browser auto-update cadence, but absent a paired sandbox escape it is not an immediate full-system-compromise emergency.

An attacker hosts or compromises a web page containing specially crafted HTML/content that triggers the use-after-free in Chrome's Compositing component when rendered. A victim who merely visits the page (UI:R) has attacker-controlled code executed within the browser's renderer sandbox. No public exploit is referenced, and full host compromise would additionally require chaining a separate sandbox-escape vulnerability.