Google Chrome EUVD-2026-105614

Exploitation requires a victim using Google Chrome on Windows at a version prior to 156.0.8078.47 to actively load an attacker-controlled crafted HTML page (UI:R); it is unauthenticated (PR:N) and network-delivered but cannot be triggered without this user-initiated page visit. The impact is strictly bounded: the attacker can only potentially READ memory confined to within the sandbox - there is no integrity or availability impact (I:N/A:N), no code execution, and no sandbox escape described. Exploitation is limited to the Windows platform and is eliminated by updating to 156.0.8078.47 or later.

Signals align toward a moderate, de-prioritized risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction and yields only confidentiality impact (C:H, I:N, A:N) - consistent with the description's claim of reading memory *inside* the sandbox rather than achieving code execution or a sandbox escape. The EPSS score is low (0.23%, 13th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Google rated this Medium severity, matching the limited scope. There are no strongly conflicting signals: a 'remote attacker' with network vector is reconcilable with the browser-drive-by model because exploitation still requires the victim to load a crafted page (UI:R). Note that the description only states memory can be read 'potentially,' and the single Chromium issue reference (issues.chromium.org/553150372) is access-restricted, so the precise exploitability and whether the read is attacker-controlled cannot be independently verified. Overall this is a patch-in-cycle item, not an emergency.

An attacker hosts or injects a crafted HTML page and lures a victim running an unpatched Chrome on Windows (prior to 156.0.8078.47) to visit it. The malicious page triggers a memory-corruption condition in the Core component that lets the attacker read memory contents within the renderer sandbox, potentially leaking sensitive in-process data. No public proof-of-concept is referenced, and exploitation requires the user to load the page.