Google Chrome EUVD-2026-105726

Exploitation requires the victim to visit or load attacker-controlled crafted HTML in Chrome (UI:R - user interaction is mandatory), and the affected build must be prior to 156.0.8078.47. The vulnerable code path is the WebAppInstalls component, associated with Progressive Web App / web app install handling in the browser. The key LIMITING factor is sandbox containment: the description explicitly states code execution occurs 'inside the sandbox', meaning this flaw alone does not escape the renderer to the host and would need to be chained with a separate sandbox-escape bug for full system compromise - which is why Google rated it Low despite the high CVSS. No authentication is required (PR:N), but auto-updating Chrome installations are protected once the stable channel update is applied.

Signals conflict sharply here and that is the central finding. NVD assigns CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which on its face reads as critical-tier remote code execution, yet Google's own Chromium security team rated this 'Low' severity. The reconciling detail is in the description: the use-after-free in WebAppInstalls allows code execution ONLY 'inside the sandbox' - i.e. it does not by itself achieve a renderer sandbox escape, so an attacker is confined to the already-untrusted renderer process rather than gaining host-level control. That containment is what the Chromium 'Low' rating reflects and what the CVSS base metrics fail to capture. There is no CISA KEV listing and no public exploit code or POC identified in the provided data, so exploitation is not confirmed in any form. EPSS is not supplied. No SSVC decision data is supplied. Net: this is a legitimate memory-corruption bug worth patching via the normal Chrome auto-update cycle, but it is NOT a drop-everything priority - the high CVSS overstates real-world risk because of sandbox containment, absence of known exploitation, and vendor's own Low rating. Treat the 8.8/Low discrepancy as a known artifact, not an unresolved question.

A victim using an affected Chrome build (prior to 156.0.8078.47) navigates to a web page the attacker controls, which serves crafted HTML that triggers the use-after-free in the WebAppInstalls component. Successful exploitation lets the attacker run arbitrary code within the browser's renderer sandbox, giving control over the compromised tab's data but not, by itself, the underlying host. No public exploit or POC is identified in the provided data, and exploitation requires the user to visit the malicious page (UI:R).