Google Chrome EUVD-2026-105670

Exploitation requires the victim to use a Chromium-based browser (Chrome before 156.0.8078.47) and to visit or load attacker-controlled HTML that exercises the HID (WebHID) code path; per CVSS UI:R, successful exploitation depends on this user interaction, which is the primary limiting factor. No authentication or prior privileges are needed (PR:N) and the attack is network-delivered (AV:N), but the impact is confined to a read-only memory disclosure inside the renderer sandbox (C:H, I:N, A:N) - it does not by itself grant code execution or escape the sandbox. The scope is unchanged (S:U), so by itself the leak stays within the compromised renderer process.

Signals are consistent and point to a genuine-but-moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must open a crafted HTML page) and is limited to a confidentiality impact with no integrity or availability effect. This matches the description: an out-of-bounds read (CWE-125) in Chrome's HID implementation that leaks memory contents from inside the renderer sandbox. The exploitation-probability signals all argue against urgency: EPSS is 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. Google itself rated the Chromium severity as Medium, which aligns with the sandbox-contained, read-only nature of the bug. No SSVC decision data was provided. Net assessment: a real vulnerability worth patching on the normal browser-update cadence, but not an emergency - the combination of required user interaction, read-only confidentiality impact, and low EPSS places it well below actively-exploited or remote-code-execution-class Chrome bugs. One caveat: an out-of-bounds read that only leaks sandboxed memory is often a building block chained with a sandbox-escape bug rather than a standalone high-impact issue, so its practical danger depends on being combined with other flaws.

An attacker hosts a malicious web page containing crafted content that exercises the WebHID code path, then lures a victim into visiting it (e.g., via a link or malvertising). When the page is rendered, the out-of-bounds read in Chrome's HID handling leaks adjacent memory from within the renderer sandbox back to attacker-controlled script, potentially disclosing sensitive data or defeating ASLR to aid a follow-on exploit. No public exploit identified at time of analysis, and the attack requires the victim to open the page.