Google Chrome EUVD-2026-105654

Exploitation requires a victim using Chrome desktop prior to 156.0.8078.47 to actively visit an attacker-controlled web page serving crafted audio content that is processed by Chrome's Audio component (UI:R - the attack cannot succeed without this user navigation). No authentication is required (PR:N) and no non-default configuration is needed. The principal limiting factor is that successful code execution is confined to Chrome's renderer sandbox (S:U, 'inside the sandbox'); converting this into host compromise requires chaining with a separate sandbox-escape vulnerability, which this CVE does not supply. User interaction and automatic browser updates further constrain realistic exploitation.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction (visiting a crafted HTML page). A critical mitigating signal, however, is in the description itself: the memory corruption allows code execution ONLY 'inside the sandbox' with scope unchanged (S:U) - meaning a successful exploit is contained within Chrome's renderer sandbox and does not by itself yield host compromise, so the high C/I/A impacts apply to the sandboxed process rather than the underlying OS. This is corroborated by Google/Chromium's own rating of 'Medium' severity, which contrasts notably with the 8.8 High numeric score; the gap reflects the sandbox containment that CVSS base metrics do not credit. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or imminent exploitation. Net assessment: this is a real but moderate-priority browser bug - patch in normal cadence. It would become high priority only if chained with a separate sandbox-escape vulnerability, which this CVE alone does not provide.

An attacker hosts or compromises a web page containing crafted audio content and lures a victim running a vulnerable Chrome build (prior to 156.0.8078.47) to visit it. When the browser's audio component processes the malicious data, the memory corruption is triggered and the attacker achieves arbitrary code execution confined to the renderer sandbox. No public exploit identified at time of analysis, and the attack requires the user to navigate to the attacker-controlled page (UI:R).