Google Chrome EUVD-2026-105609

Exploitation requires the victim to load a crafted HTML page AND to engage Chrome DevTools against it (the vulnerable component), on a Chrome version prior to 156.0.8078.47. Limiting factors: user interaction is required (UI:R); DevTools is a developer feature not active during routine browsing, so default browsing sessions are not exposed; and successful exploitation grants code execution only inside the sandbox (S:U), requiring an additional sandbox-escape vulnerability to compromise the host. Authentication is not required (PR:N), but the DevTools-engagement precondition substantially narrows the realistic attack surface.

Signals conflict and net out to moderate real-world priority despite the headline CVSS 8.8. The provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) models network-reachable, unauthenticated code execution triggered by a crafted HTML page, which drives the high base score - but Google/Chromium independently rated this 'Medium', and the description explicitly scopes the outcome to arbitrary code execution INSIDE the sandbox (S:U, no sandbox escape), so a successful attack yields control of a renderer/DevTools context rather than the host. The affected component is DevTools, a developer feature not engaged during normal browsing, which materially raises the practical bar beyond what AC:L suggests. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate memory-corruption bug worth patching via normal Chrome update cadence, not an emergency; the vendor 'Medium' rating and sandbox containment argue against treating the 8.8 as a true critical. Verify: the 8.8 base score and the vendor 'Medium' severity diverge - the divergence is explained by sandbox containment (S:U) and the non-default DevTools requirement, which base CVSS does not capture.

An attacker hosts or injects a specially crafted HTML page and lures a developer or user who then inspects or interacts with it using Chrome DevTools, triggering a memory-corruption flaw (CWE-119) in the DevTools component. Because the flaw yields code execution confined to the sandbox (S:U), the attacker gains control of that sandboxed context but must chain a separate sandbox-escape bug to reach the host. No public exploit is identified at time of analysis, and the attack requires user interaction (UI:R).