Google Chrome EUVD-2026-105688

Exploitation requires the victim to use the Web Workers feature path in Chrome by loading attacker-controlled HTML/JavaScript - i.e., the user must actively visit or be redirected to a malicious page (UI:R). No authentication is required (PR:N) and default Chrome configurations are affected, as Web Workers are a standard, enabled web platform feature. The key LIMITING factor is that resulting code execution is confined to the renderer sandbox (scope unchanged, S:U) per the description and Google's LOW severity rating; meaningful system-level impact requires chaining with a separate sandbox-escape vulnerability. Required user interaction and Chrome's rapid auto-update mechanism further constrain real-world exploitation windows.

Signals are mixed in a way that matters for prioritization. The NVD CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, implying remote, unauthenticated, low-complexity code execution with only user interaction required. However, the description explicitly limits the outcome to 'execute arbitrary code inside the sandbox,' and Google's own Chromium severity rating is LOW - a significant conflict with the 8.8 CVSS. This gap is explained by scope: the flaw yields renderer-process code execution confined by Chrome's sandbox, not a full sandbox escape or host compromise, so real-world impact is materially lower than the raw 8.8 suggests and typically requires chaining with a separate sandbox-escape bug to become dangerous. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: genuine but not emergency priority - patch via normal Chrome auto-update cadence; treat as a high-CVSS-but-vendor-rated-low issue absent exploitation signals. Note the conflict explicitly: CVSS 8.8 vs. Chromium 'Low' severity, and 'arbitrary code execution' is sandbox-contained per the description, not host-level.

A user with a vulnerable Chrome build (prior to 156.0.8078.47) visits an attacker-controlled web page containing crafted HTML/JavaScript that abuses a Web Workers use-after-free. The freed object is reclaimed and manipulated to corrupt memory and execute attacker code within the renderer sandbox. No public POC is identified at this time, and the code runs confined to the sandbox unless combined with a separate escape primitive.