Google Chrome EUVD-2026-105627

Exploitation requires a victim running Google Chrome on Windows prior to 156.0.8078.47 to actively open or navigate to an attacker-controlled crafted HTML page that exercises the ANGLE graphics backend (UI:R / required user interaction is the primary limiting factor). No authentication or elevated privileges are needed (PR:N), and no special non-default configuration is indicated - ANGLE is Chrome's default rendering translation layer. The key limit on real-world impact is that successful code execution is confined within the renderer sandbox (scope unchanged); escaping to the host requires chaining an additional sandbox-escape vulnerability.

This is a credible high-priority browser flaw but not a top-of-queue emergency on current evidence. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated memory-corruption (CWE-119) bug in ANGLE requiring only that a victim open a crafted HTML page - a classic drive-by renderer-RCE pattern. The critical mitigating signal, stated in the description and consistent with S:U (scope unchanged), is that code execution is confined INSIDE the Chrome sandbox: a successful exploit gives attacker control of the renderer process, not the host, and would need to be chained with a separate sandbox-escape to achieve full system compromise. No EPSS score was supplied, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public POC indicated in the input, so exploitation status is 'no public exploit identified at time of analysis'; Chromium rated this 'High' (not Critical) internally. The chromium issue tracker entry (550626693) is access-restricted per Google's standard embargo, which is normal and not evidence of in-the-wild use. Net: real and worth patching promptly given Chrome's footprint and the drive-by vector, but absent KEV/EPSS/POC data this reads as a severe-but-not-yet-exploited bug rather than an active threat.

An attacker hosts or compromises a web page containing malicious content that exercises the vulnerable ANGLE graphics path, then lures a Chrome user on Windows to visit it (via phishing, malvertising, or a watering-hole). Rendering the page triggers the memory-corruption condition and runs attacker code within the sandboxed renderer process. No public exploit is identified at time of analysis, and full host compromise would require chaining a separate sandbox escape.