Google Chrome EUVD-2026-105629

Exploitation requires the victim to load attacker-controlled web content: the CVE description specifies a 'crafted HTML page', so the attacker must get a Chrome-on-macOS user to visit or render a malicious page (UI:R). Limiting factors: it is macOS-specific (not Windows/Linux builds) and affects Chrome versions prior to 156.0.8078.47, so patched users are not exposed; the flaw yields only a memory read bounded within the renderer sandbox, so it does not by itself achieve sandbox escape or code execution and would typically be chained with a separate sandbox-escape bug to be fully impactful. No authentication is required (PR:N), but no exploitation occurs against a user who does not open the malicious page.

This is a genuinely moderate-priority issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 6.5) indicates a network-reachable, low-complexity, unauthenticated bug, but it requires user interaction (UI:R - the victim must open a crafted HTML page) and has NO integrity or availability impact; the only impact is confidentiality. Critically, the description scopes the effect to reading memory INSIDE the sandbox, which bounds the confidentiality loss - this contradicts the input vector's C:H, which likely overstates impact for a sandbox-contained memory read. Google/Chromium themselves rated it only 'Medium'. The EPSS score of 0.22% (12th percentile) is low, consistent with a non-trivial-to-exploit memory-corruption primitive that leaks data but does not by itself grant code execution. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent widespread exploitation. The dominant risk driver here is Chrome's enormous deployment footprint, not the severity of any single instance. Conflict to note: input tags/CWE label this a 'Buffer Overflow' / CWE-119, yet the observable effect is a memory READ (disclosure), not control-flow hijack - treat the C:H in the input as unverified and lean on the Chromium 'Medium' rating.

An attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption flaw in Chrome's Core component on macOS; when a victim visits the page, the attacker's JavaScript/HTML reads out-of-bounds memory within the renderer sandbox, potentially leaking sensitive in-process data useful for further exploitation or bypassing ASLR. No authentication is needed, but the victim must actively load the attacker-controlled page. No public proof-of-concept exploit has been identified at time of analysis.