Google Chrome EUVD-2026-105615

Exploitation requires the victim to load attacker-controlled web content (a crafted HTML page) in an unpatched Chrome build prior to 156.0.8078.47, exercising the DataTransfer component (clipboard/drag-and-drop data handling). The CVSS vector's UI:R confirms user interaction (navigating to or opening the malicious page) is mandatory, which is the primary limiting factor. Critically, the description states code execution occurs 'inside the sandbox' (scope S:U), so this bug alone does not escape the renderer or compromise the OS - a separate sandbox-escape vulnerability would be needed for host-level impact, substantially limiting realistic severity. No authentication is required (PR:N).

Multiple severity signals partially conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim open a crafted HTML page - a typical high-severity browser profile. However, Google's own Chromium rating is only 'Medium', and the description explicitly scopes code execution to 'inside the sandbox,' meaning a successful exploit of this single bug does NOT by itself compromise the host (scope is correctly S:U); a full compromise would require chaining a separate sandbox-escape, which materially lowers standalone real-world risk versus the 8.8 number. No EPSS score was provided, so exploitation probability cannot be quantified. This CVE is NOT in CISA KEV and no POC or public exploit is referenced, and no SSVC decision data was supplied. Net: this is a legitimately patch-worthy renderer memory-corruption bug in a ubiquitous product, but the combination of a Medium vendor rating, sandbox-confined impact, and absence of any exploitation evidence suggests it is a routine 'patch-in-cycle' Chrome update rather than an emergency. Conflicting signal stated explicitly: CVSS base score (8.8 High) versus Chromium's Medium severity and sandbox-only impact - defenders should treat the sandbox confinement, not the raw 8.8, as the decisive factor.

An attacker hosts or compromises a web page containing a crafted DataTransfer payload (e.g., abusing clipboard/drag-and-drop data handling) and lures a victim running an unpatched Chrome build to visit it. When the page is rendered, the memory corruption in the DataTransfer component is triggered, allowing the attacker to potentially execute arbitrary code within the renderer sandbox. No public exploit or POC is referenced in the provided data, so this scenario is theoretical based on the vulnerability class.