Google Chrome EUVD-2026-105678

Exploitation requires the victim to load a crafted HTML page in Google Chrome on Windows prior to version 156.0.8078.47 (UI:R - mandatory user interaction such as visiting a malicious or compromised site). No authentication is required (PR:N, unauthenticated) and no non-default configuration is needed - standard Chrome rendering using the ANGLE graphics backend is sufficient. Limiting factors: the attack is confined to Windows builds, impact is contained within the renderer sandbox (no sandbox escape or code execution indicated), impact is read-only (confidentiality), and the user-interaction requirement means it cannot be triggered without victim action.

This is a medium-severity information-disclosure flaw, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 6.5) indicates a remote, unauthenticated, low-complexity attack that nonetheless REQUIRES user interaction (UI:R - the victim must visit a crafted HTML page) and has impact limited to confidentiality only, with no scope change (S:U) meaning the read stays inside the renderer sandbox rather than escaping it. Multiple low-risk signals align: EPSS is only 0.23% (13th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code has been identified, so there is no evidence of exploitation. These signals are consistent with each other and with Chromium's own 'Medium' severity rating. No SSVC decision data was provided in the input. The description's phrase 'potentially read memory inside the sandbox' is somewhat weaker than the CVSS C:H (high confidentiality) rating would suggest - an attacker gains an in-sandbox memory read, not full system data access, so C:H may slightly overstate real-world impact; treat the confidentiality rating as an upper bound. Overall: a legitimate browser bug worth patching in routine cycles, but not an emergency given no exploitation evidence, mandatory user interaction, and sandbox-contained impact.

An attacker hosts or compromises a web page containing malicious HTML that triggers the ANGLE memory-corruption condition when rendered by Chrome on Windows. A victim who visits the page could have adjacent process memory within the renderer sandbox disclosed to attacker-controlled script, potentially leaking sensitive data. No public exploit code has been identified at time of analysis, and successful attack requires luring the victim to the page.