Google Chrome EUVD-2026-105680

Requires user interaction (CVSS UI:R): the victim must load an attacker-controlled or compromised HTML page in a vulnerable Chrome build (any version prior to 156.0.8078.47). No authentication and no special configuration is needed - the flaw is reachable against default Chrome installations simply by rendering malicious web content. Key LIMITING factor: per the description, resulting code execution is confined 'inside the sandbox,' so by itself it does not compromise the host operating system; escaping to full host RCE would require chaining an additional sandbox-escape vulnerability. Exploitation is further limited to users who have not yet applied the 156.0.8078.47 update.

Signals are mostly consistent toward a serious but not emergency-tier browser flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes a network-reachable, low-complexity, unauthenticated bug requiring only that the victim load a crafted HTML page - the classic drive-by browser exploitation profile. However, there is a material tension between scoring sources: the Chromium team rated this 'Medium' severity, while NVD-style CVSS yields 8.8 HIGH. The reconciling factor is in the description itself - code execution occurs 'inside the sandbox,' i.e. this is a renderer-level memory-corruption primitive (CWE-119) that does NOT by itself escape Chrome's sandbox or reach the host OS, which is why Chromium capped it at Medium; full host compromise would require chaining a separate sandbox-escape bug. On exploitation likelihood: EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Treat this as a high-priority patch-management item (ubiquitous product, remote drive-by vector, vendor patch available) rather than an actively-exploited zero-day fire drill. Missing data to note explicitly: no EPSS score available to gauge statistical exploitation probability, and no SSVC decision data provided - prioritization here rests on CVSS vector plus deployment footprint, not on measured exploitation signals.

An attacker hosts or compromises a web page containing malformed content that triggers the memory-corruption flaw in Chrome's PlatformIntegration component. When a victim using a Chrome build prior to 156.0.8078.47 visits the page, the attacker gains arbitrary code execution within the renderer sandbox, enabling theft of same-site data or use as the first link in a sandbox-escape chain. No public exploit code is identified at time of analysis, and the attack requires user interaction (loading the page).