Google Chrome EUVD-2026-105731

Exploitation requires the victim to use an unpatched Google Chrome build prior to 156.0.8078.47 and to actively load an attacker-controlled crafted HTML page that triggers the BrowserTag memory-corruption path (UI:R). No authentication or prior privileges are needed (PR:N), and default configurations are affected - there is no special feature flag or non-default setting named in the description. The principal limiting factors are the mandatory user interaction (the victim must visit the malicious page) and the sandbox containment of the flaw: the memory read is confined inside the renderer sandbox (S:U) and does not by itself provide code execution, integrity, or availability impact, which is why Google rated it 'Low.'

This is a genuinely low-priority issue despite a moderate 6.5 CVSS score, and the signals are consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw, but one that requires user interaction (visiting a crafted page) and yields only a confidentiality impact (I:N/A:N) that is explicitly contained within the renderer sandbox (S:U, no scope change). Google's own Chromium security team rated this 'Low' severity, which is the most authoritative signal here and directly undercuts the C:H in the NVD-style vector - reading memory inside the sandbox is a bounded information leak, not a sandbox escape or code execution. EPSS reinforces low real-world risk at 0.22% (12th percentile). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is neither actively exploited nor weaponized. Note the tension worth flagging to defenders: the vector's C:H overstates impact relative to the vendor 'Low' rating and the sandbox-contained description - treat the practical confidentiality impact as limited.

An attacker hosts or compromises a web page containing crafted HTML that triggers a memory-corruption condition in Chrome's BrowserTag handling; a victim running an unpatched Chrome (prior to 156.0.8078.47) visits the page and the attacker's script potentially reads adjacent memory contents inside the renderer sandbox. The leak is confined to the sandbox and does not itself grant code execution or escape. No public exploit identified at time of analysis, so practical exploitation would require an attacker to develop the technique independently.