Google Chrome EUVD-2026-105683

Exploitation requires the victim to load attacker-controlled crafted HTML in a vulnerable Chrome build prior to 156.0.8078.47, triggering a use-after-free in the Extensions component (UI:R - the user must visit/open the page; it is not automatic or server-side). The critical LIMITING factor is that resulting code execution is confined to the browser sandbox per the vendor description, so without a separate sandbox-escape vulnerability the attacker cannot reach the host operating system. No authentication is required (PR:N, unauthenticated), and no special non-default configuration is named - standard desktop Chrome with the Extensions subsystem is sufficient.

Signals conflict sharply here and that conflict is the headline. The NVD CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this as High, driven by network vector, low complexity, no privileges, and high C/I/A impact - but the vendor description explicitly states code execution is confined 'inside the sandbox,' and Chromium's own security team rated the severity 'Low.' A sandboxed renderer use-after-free without a chained sandbox-escape cannot directly compromise the host OS, so the C:H/I:H/A:H impact metrics appear overstated relative to the real blast radius; the Chromium 'Low' rating is the more credible impact signal. No EPSS score is provided, there is no CISA KEV listing, and no public proof-of-concept is referenced, so exploitation pressure is currently low: no public exploit identified at time of analysis. Realistically this is a patch-on-normal-cadence browser bug, not an emergency - the headline 8.8 is a high-CVSS-but-moderate-real-risk case because of sandbox containment, user-interaction requirement, and absence of active-exploitation or exploit-availability signals. Verify the sandbox-containment claim against the vendor advisory before down-ranking, since a future chained escape would change the calculus.

An attacker hosts or compromises a web page containing malicious HTML that triggers the use-after-free in Chrome's Extensions component when a victim visits it. Successful exploitation yields arbitrary code execution confined to the browser's renderer sandbox, so impact is limited unless paired with a separate sandbox-escape bug. No public proof-of-concept is referenced, and exploitation requires the user to load the crafted page (UI:R).