Google Chrome EUVD-2026-105706

Exploitation requires the victim to open an attacker-controlled crafted HTML page in Google Chrome versions prior to 156.0.8078.47, and the flaw resides specifically in the DevTools component (CVSS UI:R confirms required user interaction). Key limiting factors: successful code execution is confined to the browser sandbox (scope unchanged, S:U), so it does not by itself yield host-level compromise without a separate sandbox escape; the DevTools surface is primarily exercised by developers rather than during ordinary browsing, reducing the realistic victim pool; and the vendor rates the issue 'Low' severity. No authentication is required (PR:N), but user interaction is mandatory.

Signals are mixed and skew lower than the headline score suggests. The NVD CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) treats this as a network-reachable, low-complexity, unauthenticated flaw with full CIA impact. However, two signals pull strongly against that: (1) Chromium's own security severity rating is explicitly 'Low', and (2) the description states code execution occurs 'inside the sandbox' (scope unchanged, S:U) - meaning a successful exploit is contained by Chrome's renderer/process sandbox rather than achieving host compromise, and would require a separate sandbox-escape chain to be broadly dangerous. Exploitation also requires user interaction (UI:R - the victim must open a crafted HTML page), and realistically interaction with DevTools, which is a developer-facing feature not exercised by ordinary browsing, further narrowing the practical attack surface. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - this is not a confirmed in-the-wild priority. Net: despite an 8.8 base score, the vendor's 'Low' rating, sandbox containment, and DevTools/user-interaction preconditions make this a patch-on-normal-cadence item rather than an emergency, for most environments. The conflict between the 8.8 NVD score and Chromium's 'Low' label should be resolved in favor of the vendor context: treat the real-world risk as low-to-moderate.

An attacker hosts a crafted HTML page and lures a Chrome user (likely a developer with DevTools engaged) into opening it; the page triggers a memory-corruption (buffer overflow, CWE-119) condition in DevTools, letting the attacker run arbitrary code within the browser sandbox. No public exploit code was identified in the provided data, and the resulting execution is sandbox-confined, so full system compromise would require chaining an additional sandbox-escape vulnerability.