Google Chrome EUVD-2026-105625

Exploitation requires the victim to navigate to attacker-controlled content using a vulnerable Chrome build (prior to 156.0.8078.47) - the UI:R / crafted-HTML-page requirement is the primary limiting factor, as no exploitation occurs without the user loading the malicious page. The flaw is in Chrome's FileSystem component and triggers via a crafted HTML page against default configurations (no special feature toggle is named in the description), so no non-default setting is required. Critically, code execution is confined to the renderer sandbox (S:U): absent a separate sandbox-escape chain, the attacker does not gain host-level code execution, which meaningfully limits real-world impact versus a full RCE.

This is a genuine high-priority browser vulnerability, though its signals require careful reading. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - the classic drive-by profile for browser memory-corruption bugs, and Chromium's own rating of 'High' corroborates the 8.8 score. However, the description explicitly scopes code execution to 'inside the sandbox,' and the vector correctly reflects this with S:U (scope unchanged): absent a chained sandbox-escape, the attacker gains control of the renderer process only, not the host. EPSS probability is NOT provided in the input, and there is NO CISA KEV listing and NO public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data means breadth of real-world exploitation cannot be quantified from this input - but Use-After-Free flaws in Chrome's FileSystem component are historically high-value targets frequently weaponized post-disclosure, so defenders should patch promptly rather than discount this as a high-CVSS/low-real-risk issue. Net: real priority driven by ubiquity and exploit history, tempered by sandbox containment and the current lack of confirmed in-the-wild activity.

An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's FileSystem implementation when the victim simply visits it. Successful exploitation yields arbitrary code execution within the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape to fully compromise the host. No public exploit code is identified in the provided data, but UAF flaws of this class are commonly weaponized after disclosure.