Google Chrome EUVD-2026-105606

Exploitation requires the victim to use a vulnerable Google Chrome desktop build prior to 156.0.8078.47 and to actively load an attacker-controlled crafted HTML page (UI:R) - there is no fully passive, zero-click vector. No authentication or special privileges are needed (PR:N), and no non-default configuration is required; the SiteIsolation feature exercised is standard in Chrome. Limiting factors: the read is confined to memory inside the renderer sandbox (S:U, C:H/I:N/A:N), so it discloses information but does not by itself corrupt data, achieve code execution, or escape the sandbox; the required user interaction and read-only impact meaningfully reduce real-world risk relative to a zero-click RCE.

Signals are consistent and point to a genuine-but-moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must visit attacker-controlled content - and is confined to confidentiality impact only (C:H, I:N, A:N). Chromium itself rated this Medium severity, which aligns with the scope-unchanged, read-only nature of the bug. EPSS corroborates low near-term exploitation likelihood at 0.22% (12th percentile). The vulnerability is NOT on the CISA KEV list and there is no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. There are no conflicting signals here: a browser information-disclosure bug requiring a user to open a crafted page, with a sandbox-bounded read, is a legitimate patch-soon item but not an emergency drop-everything issue. The one caveat is reach - Chrome's near-universal deployment means even a Medium bug warrants prompt patching, and the 'read memory inside the sandbox' primitive could serve as one link in a larger exploit chain (e.g., combined with a sandbox-escape) even though on its own it does not break the sandbox.

An attacker hosts or injects a crafted HTML page and lures a victim running a vulnerable Chrome build (prior to 156.0.8078.47) into visiting it, for example via a phishing link or a malicious ad. When the page is rendered, the SiteIsolation code performs an out-of-bounds read, leaking adjacent memory contents back to attacker-controlled script within the sandboxed renderer. No public exploit code is identified at time of analysis, and the attack requires the victim to actively load the page (UI:R).