Google Chrome EUVD-2026-105738

Exploitation requires the victim to open attacker-controlled crafted HTML in Chrome (UI:R), and the memory corruption resides in the DevTools component. The resulting code execution is explicitly limited to WITHIN Chrome's sandbox, so it does not by itself grant host-level compromise - a separate sandbox-escape would be needed for meaningful breakout. Affected builds are Chrome prior to 156.0.8078.47; patched versions are not exploitable. Limiting factors: mandatory user interaction, dependence on the DevTools code path, and the sandbox boundary that contains the attacker's execution.

Signals are notably mixed. The NVD-style CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw with only user interaction (visiting a crafted page) required - which on paper is a serious drive-by condition. However, the description and Chromium's own rating directly temper this: Google labels the issue 'security severity: Low,' and critically the code execution is confined 'inside the sandbox,' meaning an attacker does NOT achieve host/renderer-breakout compromise on its own. This is a classic high-CVSS-but-moderated-real-risk case: the base score does not model Chrome's sandbox as a mitigating boundary, so the 8.8 overstates standalone impact - sandboxed code execution typically must be chained with a separate sandbox-escape to be weaponizable. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided in the input, so there is no evidence of active or imminent exploitation. Net: patch promptly as part of normal Chrome update hygiene, but this is not a standalone emergency given the sandbox confinement and the absence of exploitation signals. Verify the apparent conflict - CVSS C:H/I:H/A:H versus Chromium's 'Low' rating and explicit sandbox containment - against the vendor advisory before treating it as full RCE.

An attacker hosts or injects a crafted HTML page and lures a victim into visiting it in Chrome (UI:R); when processed it triggers memory corruption in the DevTools component, letting the attacker run arbitrary code confined within Chrome's sandbox. No public exploit was identified at time of analysis, and meaningful host compromise would require chaining this with a separate sandbox-escape vulnerability.