Google Chrome EUVD-2026-105605

Exploitation requires the victim to load an attacker-crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) that exercises the Speech component - this is the exact trigger stated in the advisory and reflected in the UI:R metric. No authentication and no special non-default Chrome configuration are required (the Speech/Web Speech functionality is part of the standard renderer). Key LIMITING factors: the attack is read-only (C:H, I:N, A:N) so it cannot modify data or execute code on its own; the disclosed memory is bounded by the renderer sandbox (S:U, no scope change), meaning no host or cross-process compromise results without chaining a separate sandbox-escape bug; and the required user interaction (visiting the malicious page) prevents fully automated, interaction-free compromise.

Signals align consistently toward a MODERATE, low-priority issue despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes an unauthenticated, low-complexity remote attack that nonetheless requires user interaction (UI:R - the victim must load a crafted HTML page) and yields only a confidentiality impact (C:H) with no integrity or availability effect and no scope change - i.e. an information-disclosure read, not code execution. This matches the description's 'read memory inside the sandbox,' meaning the leak is bounded by the Chrome renderer sandbox and does not by itself constitute a sandbox escape. Exploitation-likelihood signals reinforce low urgency: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code is referenced. Google/Chromium rated the severity Medium, consistent with the CVSS and EPSS. There are no conflicting signals here - the network vector is real but gated by required user interaction and a read-only, sandbox-bounded impact. Net assessment: patch via routine Chrome update cadence; this is not an emergency-priority vulnerability.

An attacker hosts or compromises a web page containing specially crafted HTML that triggers the memory-corruption flaw in Chrome's Speech component when the page is rendered. A victim running a vulnerable Chrome version (prior to 156.0.8078.47) visits the page, and the attacker reads out-of-bounds memory from within the renderer sandbox, potentially leaking sensitive in-process data. No public exploit code is identified at time of analysis, and successful exploitation requires the user to visit the attacker-controlled page.