Google Chrome EUVD-2026-105671

Exploitation requires the victim to actively load a crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) that reaches the Transactions Platform component (UI:R confirms required user interaction). No authentication is required (PR:N). The primary limiting factor is that resulting code execution is confined to the sandboxed renderer process (S:U, and the description states execution occurs 'inside the sandbox'); achieving host-level compromise would require chaining a separate sandbox-escape vulnerability. No special non-default configuration is indicated - the default browser configuration is affected. Chrome's automatic update mechanism also narrows the realistic exposure window.

This is a genuine patch-priority issue but not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - a classic browser drive-by profile. However, two signals pull the real-world risk down. First, Google's own Chromium severity rating is Medium, notably lower than the 8.8 CVSS, because the description explicitly scopes code execution to 'inside the sandbox' (S:U, no scope change), meaning a successful exploit does not by itself escape the renderer to compromise the host; it would typically need to be chained with a separate sandbox-escape bug for full system compromise. Second, no EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The C:H/I:H/A:H impact metrics should be read as impact within the sandboxed renderer process, not the underlying OS. Net: treat as a standard high-priority browser update (Chrome auto-update normally covers this quickly), not a zero-day fire drill. The CVSS-vs-vendor-severity gap is the key tension and is driven by sandbox containment.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the memory corruption in Chrome's Transactions Platform component. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) simply visits the page, and the attacker potentially gains arbitrary code execution within the browser's sandboxed renderer process. No public exploit code is identified at time of analysis, and the attacker would still need a separate sandbox escape to affect the host OS.