Google Chrome EUVD-2026-105659

Exploitation requires the victim to open a crafted HTML page in Google Chrome on Android running a version prior to 156.0.8078.47 (UI:R - user must navigate to or load attacker-controlled content). No authentication is required (PR:N) and the default browser configuration is sufficient - there is no special feature or non-default setting named in the advisory. Limiting factors: the flaw is in the Android build of Chrome specifically; any resulting code execution is confined to the renderer sandbox (S:U), so a separate sandbox-escape would be needed for host compromise; and the required user interaction plus the read-class CWE (CWE-125) constrain realistic impact toward information disclosure rather than guaranteed RCE.

Signals are moderately conflicting and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a user open a crafted HTML page - trivial for a browser. However, Chromium's own security severity rating is 'Medium', and the CWE is CWE-125 (out-of-bounds READ), which typically yields information disclosure rather than full code execution; the description only states code execution 'potentially' and explicitly 'inside the sandbox', meaning the renderer sandbox still contains the attacker (consistent with S:U, no scope change). This gap - CVSS 8.8 High vs. vendor 'Medium' and a read-class CWE - suggests the 8.8 reflects a worst-case code-execution assumption rather than confirmed impact; treat the real-world impact as likely information disclosure / sandboxed compromise unless chained with a separate sandbox-escape. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is 'no public exploit identified at time of analysis'. A patch is available from Google, which lowers risk for patched fleets. Net: patch promptly because of Chrome's ubiquity and the one-click trigger, but this is not confirmed as actively exploited and is sandbox-contained, so it ranks below a verified KEV/escape chain.

A remote attacker hosts or injects a crafted HTML page (e.g., via a malicious ad, phishing link, or compromised site) that a Chrome-on-Android user opens, triggering an out-of-bounds read in the browser's Core component. This may leak adjacent memory contents or, in the worst case, be leveraged toward arbitrary code execution within the renderer sandbox. No public proof-of-concept was provided in the intelligence, and exploitation requires the victim to actively load the attacker's page (UI:R).