Google Chrome EUVD-2026-105601

Exploitation requires the victim to open attacker-controlled web content in a vulnerable Chrome build (any version prior to 156.0.8078.47) - this user interaction (UI:R: visiting a crafted HTML page) is the primary limiting factor, as the flaw cannot be triggered without the victim navigating to the malicious page. No authentication or special Chrome configuration is indicated; the missing authorization check in the Animation component appears to affect default installations. There is no evidence of active exploitation, and impact is bounded to bypassing the web origin (same-origin) policy - i.e., unauthorized cross-origin access - rather than arbitrary code execution. Automatic browser updates to 156.0.8078.47 or later close the window.

Signals conflict in an informative way. The input CVSS base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) paints this as near-critical, but Google's own Chromium rating is Medium, and the underlying weakness (CWE-862 Missing Authorization leading to a same-origin/web-origin policy bypass) typically yields cross-origin data disclosure and manipulation rather than full host compromise - so the A:H (and arguably the uniform C:H/I:H) in the supplied vector looks inflated for an origin-policy bypass. EPSS is low at 0.24% (14th percentile), the CVE is NOT on CISA KEV, and no public exploit is identified, so there is no evidence of real-world exploitation. The practical risk is therefore moderate and conditioned on user interaction (UI:R): a victim must visit attacker-controlled content. Net assessment: this is a patch-on-normal-cycle browser flaw, not an emergency - high nominal CVSS but low observed exploitation pressure, consistent with Google's Medium rating. Verify the true availability impact with the vendor, as A:H appears unsupported by the 'origin policy bypass' description.

A remote, unauthenticated attacker hosts a crafted HTML page and lures a Chrome user (via link, ad, or compromised site) to open it. Exploiting the missing authorization check in the Animation component, the page bypasses Chrome's web origin policy to read or tamper with data belonging to another origin the victim is logged into. No public exploit code is identified at time of analysis, and success depends on the victim loading the malicious page (UI:R).