Google Chrome EUVD-2026-105679

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to load a crafted HTML page containing attacker-controlled content that triggers the V8 memory-corruption bug (UI:R - user interaction is the primary limiting factor). No authentication or special configuration is needed; it works against default Chrome installations since V8 and HTML rendering are core, always-enabled components. The critical limiting factor is sandbox containment: the description states code executes INSIDE the sandbox, so this vulnerability by itself does not yield host-level compromise without an additional sandbox-escape exploit.

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a realistic bar for a web browser. However, a key mitigating signal is explicit in the description: arbitrary code executes INSIDE the Chrome sandbox, so this V8 memory-corruption bug alone compromises only the renderer process, not the host; full system compromise would require a separate sandbox-escape chain. Note the signal conflict: Google's own Chromium severity rating is 'Medium', while the NVD CVSS base scores 8.8 ('High') - the vendor's lower rating likely reflects the sandbox containment that the CVSS scope-unchanged (S:U) metric does not fully capture. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent widespread exploitation; this should be treated as a standard high-priority browser patch rather than an emergency. The combination of ubiquitous deployment and low attack complexity still warrants prompt patching, but the absence of exploitation signals plus sandbox containment argues against crisis-level urgency.

An attacker hosts or compromises a web page containing malicious JavaScript that triggers the V8 memory-corruption bug; when a victim running an unpatched Chrome (before 156.0.8078.47) browses to it, the attacker gains arbitrary code execution within the renderer sandbox. To affect the underlying system the attacker would need to chain this with a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data at time of analysis.