Google Chrome EUVD-2026-105641

Exploitation requires a user of a Chrome build prior to 156.0.8078.47 to load an attacker-controlled crafted HTML page (UI:R) - i.e., drive-by visit to a malicious or compromised site, or rendering of attacker HTML. No authentication or prior privileges are needed (PR:N), and the vulnerable Internals code path is reachable in default browser configurations. The primary limiting factor is the required user interaction (the victim must navigate to or render the malicious page); there is no indication a non-default setting or extension is needed. Chrome's automatic update mechanism means patched populations shrink the window quickly after the fixed build rolls out.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) describes a remotely reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page, with a scope change (S:C) reflecting the explicit sandbox escape ('execute arbitrary code outside the sandbox'). A sandbox escape plus renderer code execution is among the most dangerous Chrome bug classes. However, there is a notable signal conflict: Google's own Chromium severity rating is 'Medium', which is markedly lower than the 9.6 CVSS - likely because Chromium severity weighs factors such as exploitation difficulty and whether a second bug is needed, so treat the 9.6 as the upper bound rather than a settled consensus. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Net: this is a genuine high-priority patch item because of the sandbox-escape RCE potential and ubiquitous attack surface, but the absence of KEV/POC/EPSS data and the vendor's Medium rating argue against treating it as actively-exploited-emergency tier. Prioritize rapid patching via normal Chrome auto-update rather than incident-response escalation.

An attacker hosts or compromises a web page containing specially crafted HTML/JavaScript that triggers the use-after-free in the Internals component; when a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the freed memory is reclaimed and manipulated to execute attacker-controlled code that escapes the renderer sandbox. No public exploit code was identified in the provided data, so active exploitation cannot be confirmed. The attack needs only user interaction (visiting the page) and no authentication (UI:R, PR:N).