Google Chrome EUVD-2026-105695

Exploitation requires the victim to navigate to an attacker-controlled web page containing crafted HTML that exercises the Google Lens feature code path in Chrome - this user interaction (UI:R) is the primary limiting factor, as there is no drive-by auto-trigger without the victim loading the page. No authentication is required (PR:N). The impact is further constrained to memory reads within the renderer sandbox: it does not escape the sandbox, write memory, or affect availability, so leaked data is limited to whatever resides in the affected process. Affects Chrome versions prior to 156.0.8078.47 on desktop; updating to that build or later removes the condition.

This is a genuinely low-priority issue despite a moderate 6.5 CVSS base score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, with high confidentiality impact but no integrity or availability impact - consistent with an information-disclosure bug rather than code execution. Critically, the impact is bounded: the description states the attacker can only 'potentially read memory inside the sandbox,' so this is NOT a sandbox escape, and Chromium itself rated the security severity 'Low,' which conflicts with the C:H in the supplied CVSS vector (sandbox-confined memory reads rarely warrant C:H - this appears to be an overstated confidentiality metric). The EPSS score of 0.19% (9th percentile) indicates very low predicted exploitation likelihood. There is no CISA KEV listing and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net assessment: a low real-world risk, routine browser patch; the headline 6.5 overstates practical danger given the sandbox-bounded, read-only, user-interaction-gated nature of the flaw.

An attacker hosts or compromises a web page containing crafted HTML that triggers a memory-corruption condition in Chrome's Google Lens component when a victim navigates to it. Successful exploitation could let the attacker read memory contents within the renderer sandbox, potentially leaking sensitive in-process data, but does not by itself escape the sandbox or execute code. No public exploit code is referenced, and exploitation requires the victim to visit the attacker-controlled page (UI:R).