Google Chrome EUVD-2026-105613

Exploitation requires the victim to open a crafted HTML page in a vulnerable Google Chrome desktop build prior to 156.0.8078.47 - the CVSS UI:R and the phrase 'via a crafted HTML page' confirm user interaction (navigation to attacker content) is mandatory, which is the primary limiting factor. No authentication or special privileges are needed on the attacker side (PR:N). Critically, successful exploitation yields code execution only INSIDE the renderer sandbox (S:U); escaping to the host operating system would require chaining a separate sandbox-escape vulnerability, which substantially limits real-world impact. No non-default configuration is required; any standard vulnerable Chrome installation rendering the malicious DOM content is affected.

Multiple signals must be weighed carefully here. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring only that a victim open a crafted HTML page, with high impact to confidentiality, integrity and availability. However, the description qualifies this sharply: the attacker can 'potentially execute arbitrary code INSIDE THE SANDBOX,' and Chromium itself rated the security severity only Medium. This is a notable tension - the 8.8 base score reflects code execution impact, but Scope is Unchanged (S:U), meaning the compromise is contained within the renderer sandbox and would require a separate sandbox-escape bug to reach the host OS. No EPSS score, no CISA KEV entry, and no POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Realistically this is a patch-promptly browser bug rather than an emergency: the vendor-assigned Medium severity, the sandbox containment, and the absence of exploitation signals argue against treating the 8.8 as a drop-everything priority, while Chrome's ubiquity and the low attack complexity argue against ignoring it. Treat as routine-but-important browser patch management. EPSS is absent (not a defect, merely unavailable), so probabilistic exploitation likelihood cannot be quantified from this data.

An attacker hosts or compromises a web page containing specially crafted HTML that triggers the DOM memory-corruption bug when rendered. A victim running a vulnerable Chrome build (before 156.0.8078.47) visits the page, and the corruption is leveraged to execute attacker-controlled code within the browser's renderer sandbox. No public proof-of-concept was identified in the provided data; because UI is required (UI:R), the attacker must lure the victim to the malicious content.