Google Chrome EUVD-2026-105728

Exploitation requires the victim to load a crafted HTML page in Google Chrome on Android (versions prior to 156.0.8078.47), triggering improper input validation in the Omnibox component; the attacker does not need authentication (PR:N) but does require user interaction (UI:R) to get the victim to open the malicious content. The key limiting factor is that any resulting code execution is confined to the renderer sandbox - a sandbox escape would be needed for full device compromise - which, together with the required user click and Google's 'Low' Chromium severity rating, substantially constrains real-world impact.

Signals conflict sharply and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) paints a near-critical remote-code-execution picture, yet Google's own Chromium security team rated this issue 'Low', and the description explicitly scopes the code execution to 'inside the sandbox' - meaning the attacker gains control only of the confined renderer process, not the host. That containment is the single most important risk-reducing fact and is not reflected in the 8.8 score, which appears to treat sandboxed renderer compromise as full host CIA loss. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation or weaponization; this is no public exploit identified at time of analysis. Exploitation also requires user interaction (UI:R) - the victim must load attacker-controlled content. Net assessment: despite the high CVSS number this is a lower real-world priority - a sandbox-contained renderer flaw with no exploitation signal - though it should still be patched promptly because Chrome's ubiquity means even low-severity browser bugs reach enormous populations. Note also a data inconsistency: the description says Chrome on Android, but the primary vendor references point to a desktop Stable channel blog post; verify the affected platform with the vendor.

An attacker hosts a crafted HTML page and lures an Android Chrome user to open it (e.g., via a link in a message or ad). When the Omnibox mishandles the malicious input, the attacker triggers code execution confined within the browser's renderer sandbox. No public exploit code is known, and the single-click user interaction plus sandbox containment limit real-world impact.