Google Chrome EUVD-2026-105708

Exploitation is routed through Chrome's Extensions subsystem, which fails to properly validate input (CWE-20) when processing a specially crafted HTML page; the attacker must get the victim to load that page in a vulnerable Chrome build prior to 156.0.8078.47. The principal LIMITING factor is required user interaction (UI:R): the victim must actively navigate to or render the attacker-controlled content - there is no fully passive or wormable path. No authentication or prior privileges are needed (PR:N), and default configurations are affected, but Chrome's automatic update mechanism and the vendor's own 'Low' severity rating further constrain the realistic window and reliability of exploitation. The description's qualifier 'potentially execute arbitrary code' indicates the sandbox escape is not guaranteed and may depend on additional runtime conditions not detailed in the advisory.

The signals here are sharply conflicting and must be read carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields a Critical 9.6, describing a network-reachable, low-complexity, unauthenticated sandbox escape with full confidentiality, integrity, and availability impact - on paper a top-priority flaw. However, Google/Chromium itself rated this 'Low' severity, and the description hedges with 'potentially execute arbitrary code,' indicating the real-world impact is far more constrained than the 9.6 implies. This is a textbook high-CVSS-but-lower-real-risk case: the Chromium 'Low' rating reflects vendor assessment of exploitability difficulty and limited practical impact, directly contradicting the Critical numeric score. CONFLICT STATED EXPLICITLY: CVSS 9.6 (Critical) versus vendor Chromium severity 'Low' - the vendor's own triage should be weighted heavily and the 9.6 treated with skepticism. No EPSS score, no KEV listing, and no POC were provided; absence of EPSS/KEV means there is no evidence of active or probable exploitation. No SSVC data was supplied. Mitigating the Critical vector, exploitation requires user interaction (UI:R) - the victim must visit attacker-controlled content. On balance this is a patch-in-normal-cycle issue for most organizations rather than an emergency, driven by the vendor's Low rating and the absence of exploitation evidence, though the fast-patch posture of Chrome auto-updates largely neutralizes residual risk.

An attacker hosts a crafted HTML page and lures a victim running an unpatched Chrome (prior to 156.0.8078.47) to visit it; malformed input processed by the Extensions component triggers improper input validation that may allow code execution outside the browser sandbox. Exploitation requires the user to navigate to the malicious page (UI:R) but no authentication (PR:N). No public exploit code was identified in the provided intelligence, and the vendor rated the practical severity Low, suggesting reliable weaponization is non-trivial.