Google Chrome EUVD-2026-105746

Exploitation requires a victim using Google Chrome before 156.0.8078.47 to actively load attacker-controlled web content (UI:R) that exercises the 'Prompts' feature to trigger the use-after-free; no authentication is required (PR:N). The decisive limiting factor is that arbitrary code execution is confined to the renderer sandbox (S:U) - achieving impact on the host OS would require chaining a separate sandbox-escape vulnerability, which this CVE does not provide. Additional limiters: the attack depends on user interaction (no silent/wormable exploitation) and only affects the specified pre-156.0.8078.47 desktop builds, with the fix delivered automatically via Chrome's update channel.

Signals conflict and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) presents this as a high-severity network-reachable flaw requiring only that a user visit a crafted page, yet Google's own Chromium rating is 'Low' and the description explicitly scopes code execution to 'inside the sandbox' - i.e. within the renderer process, not full host compromise. That sandbox containment (consistent with S:U, scope unchanged) is the single most important risk-moderating fact: without a chained sandbox-escape (not described in this CVE), an attacker gains control of the renderer but not the underlying OS. Exploitation requires user interaction (UI:R), which rules out drive-by wormable spread. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net: despite the ubiquitous footprint and 8.8 base score, the practical priority is moderate - a browser use-after-free is valuable to attackers (especially as part of an exploit chain) but this specific issue is sandbox-confined, requires victim interaction, is already patched, and shows no evidence of active or public exploitation. Patch promptly as part of normal Chrome auto-update cadence rather than as an emergency.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that manipulates the Chrome 'Prompts' component to trigger a use-after-free. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page (UI:R), and the freed-object reuse lets the attacker execute arbitrary code within the renderer sandbox. No public proof-of-concept or exploit code is referenced in the provided data.