Google Chrome EUVD-2026-105626

Exploitation requires the victim to load attacker-controlled web content in Google Chrome versions prior to 156.0.8078.47 that exercises the CacheStorage API path (UI:R - the user must visit or be redirected to the crafted HTML page). No authentication or special privileges are needed on the target (PR:N), and no non-default configuration is indicated; standard Chrome with JavaScript enabled is sufficient. Limiting factors: impact is contained to reading memory within the renderer sandbox (S:U, no scope change, no stated sandbox escape), and success is described as only 'potential,' so reliable data exfiltration is not guaranteed. The required user interaction and the lack of integrity/availability impact meaningfully reduce real-world risk relative to a drive-by RCE.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (visiting a crafted HTML page) and is confined to confidentiality impact - consistent with the description's claim of reading memory inside the sandbox rather than full code execution or sandbox escape. The signals align rather than conflict: EPSS is low at 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data, so there is no evidence of active or widespread exploitation. Chromium rated the underlying bug 'High' severity, which reflects the memory-corruption class (CWE-119) and potential, but the realized impact here is information disclosure bounded by the renderer sandbox. Note a tension worth flagging: CVSS marks C:H (high confidentiality impact), yet the description says the attacker can only 'potentially read memory inside the sandbox,' which is a more limited and uncertain outcome - the practical confidentiality loss may be lower than C:H implies and should be verified against Google's advisory. Overall: patch on a normal browser update cadence; this does not warrant emergency out-of-band response absent new exploitation evidence.

An attacker hosts or compromises a web page containing malicious JavaScript/HTML that abuses the CacheStorage API to trigger memory corruption in the Chrome renderer. A victim who visits the page may have adjacent process memory read back inside the sandbox, potentially leaking sensitive in-process data. No public proof-of-concept was identified at the time of analysis, and exploitation requires the user to load the attacker-controlled page.