Google Chrome EUVD-2026-105724

Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to actively load attacker-controlled HTML (UI:R - visiting a malicious or compromised page), which triggers the use-after-free in the Views component. No authentication or special configuration is needed (PR:N), and it works against default Chrome installations. The key LIMITING factor is that successful code execution is confined to the renderer sandbox per the description; meaningful impact on the host requires a separately chained sandbox-escape vulnerability, which substantially raises the real-world bar beyond the raw 8.8 score. Required user interaction and the sandbox boundary are the primary mitigating constraints.

The input presents a notable severity conflict that defenders must reconcile: the CVSS 3.1 base score is 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yet Google's Chromium security team rated this issue 'Low' severity. This divergence is explained by the description, which states the use-after-free allows code execution 'inside the sandbox' - i.e., confined to the renderer process rather than a full sandbox escape or host compromise. CVSS scores renderer-RCE as C:H/I:H/A:H without modeling the sandbox boundary, whereas Chromium's 'Low' rating reflects that a sandboxed-renderer bug on its own has limited real-world impact absent a chained escape. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The attack is network-reachable and unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit a crafted HTML page. Net assessment: this is a standard-cadence patch priority (routine Chrome update), not an emergency. It becomes a genuine priority only if paired with a sandbox-escape chain. Verify the vendor's own 'Low' rating against your exposure before treating the 8.8 as emergency-grade.

A remote, unauthenticated attacker hosts or compromises a web page containing malicious HTML that triggers the use-after-free in Chrome's Views component. A victim running a pre-156.0.8078.47 Chrome build visits the page (satisfying UI:R), and the freed-object reuse lets the attacker execute arbitrary code within the renderer sandbox. No public POC was provided in the input, and meaningful host compromise would require chaining this with a separate sandbox-escape bug.