Google Chrome EUVD-2026-105657

Exploitation requires the victim to load attacker-controlled crafted HTML in a vulnerable Chrome desktop build prior to 156.0.8078.47 (UI:R - the user must open the page); no authentication or pre-existing privileges are needed (PR:N). The flaw is in Chrome's Network component and, unusually, yields code execution OUTSIDE the renderer sandbox, so no separate sandbox-escape chain is needed. The principal limiting factors are the required user interaction (visiting/rendering the malicious page) and the practical difficulty of turning a memory-corruption primitive into reliable arbitrary code execution against Chrome's exploit mitigations; patched builds (156.0.8078.47+) are not affected.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, unauthenticated memory-corruption flaw requiring only that a victim load a crafted HTML page, with a scope change reflecting that code executes OUTSIDE the Chrome sandbox - i.e. a direct compromise of the host rather than a contained renderer bug. That 'outside the sandbox' detail is the single most important risk signal and justifies the high CVSS. However, signals conflict: Chromium's own security severity is labeled 'Medium', which is materially lower than the 9.6 CVSS and should be reconciled with the vendor - the Chromium rating likely reflects exploitation difficulty or reachability rather than raw impact. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is indicated, so there is no evidence of active or imminent exploitation yet. In practice this is a genuine priority to patch because of Chrome's ubiquity and the sandbox-escape impact, but it is currently a 'patch promptly' item, not an 'actively-exploited-emergency' item; absent EPSS/KEV/POC data, real-world exploitation probability cannot be quantified from the inputs.

An attacker hosts or compromises a web page containing malicious HTML that triggers the network-component memory corruption; when a victim running a vulnerable Chrome build (before 156.0.8078.47) visits it, the corruption is leveraged to run attacker code outside the browser sandbox on the victim's machine. User interaction (visiting the page) is required per UI:R, but no authentication is needed. No public exploit identified at time of analysis, so weaponization would require the attacker to develop a reliable memory-corruption exploit.