Google Chrome EUVD-2026-105674

Exploitation requires a user running Google Chrome prior to 156.0.8078.47 to load an attacker-controlled or attacker-injected HTML page that exercises the vulnerable ANGLE code path; this is reflected by UI:R in the CVSS vector, so some user interaction (visiting/rendering the page) is the primary limiting factor. No authentication is required (PR:N) and no special non-default configuration is indicated - ANGLE is Chrome's default graphics translation layer, so default desktop installs are affected. The description does not state the specific rendering operation or content that triggers the memory corruption, so the exact trigger is not described in the available sources. Limiting factors beyond user interaction: the victim must be on an unpatched build, and the disclosed impact per the description is reading memory rather than confirmed code execution.

Signals conflict and should be reconciled before prioritizing. NVD scores this 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yet the Chromium project rated it Medium, and the description states only that an attacker can 'read memory' - i.e. information disclosure/confidentiality - which does not obviously support the C:H/I:H/A:H (full integrity and availability) impact in the NVD vector; this mismatch should be verified with the vendor. Exploitation signals are low: EPSS is 0.22% (11th percentile), the CVE is not in CISA KEV, and no public exploit was identified in the provided data (the chromium issue tracker link is a restricted bug reference, not working exploit code). The vuln.today decision label is 'this_week', consistent with a patched browser flaw requiring user interaction (UI:R) rather than an emergency. Net: this is a patch-on-the-normal-browser-update-cadence issue - a genuine memory-safety bug in a near-ubiquitous product, but current exploitation probability is low and no in-the-wild activity is confirmed. The main caveat is the severity/impact disagreement (NVD High + C/I/A:H vs Chromium Medium + read-only description).

An attacker hosts or injects a crafted HTML page that drives Chrome's ANGLE graphics component into a memory-corruption condition when the page is rendered. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) simply visits the page, and the flaw lets the attacker read process memory, potentially leaking sensitive in-browser data. No public exploit code was identified at time of analysis.