Google Chrome EUVD-2026-105748

Requires a victim running Google Chrome on Android at a version prior to 156.0.8078.47 to open an attacker-crafted HTML page, which triggers memory corruption in the WebAppInstalls component. No authentication is required (PR:N), but exploitation is gated by mandatory user interaction (UI:R) - the user must navigate to or render the malicious content. Exploitation is further limited to the Android platform and to unpatched versions, and achieving the claimed out-of-sandbox code execution is non-trivial, consistent with Google's own 'Low' Chromium severity rating despite the high mechanical CVSS.

Signals conflict sharply and must be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw with a scope change consistent with the description's 'execute arbitrary code outside the sandbox' (a renderer-to-host sandbox escape). However, Google's own Chromium security severity rating is explicitly 'Low', which is a direct and significant contradiction - Chromium's internal rating accounts for exploitability nuances (e.g., difficulty of actually achieving a reliable sandbox escape from this primitive) that the mechanical CVSS score does not capture. This gap strongly suggests the 9.6 overstates real-world risk and the practical priority is closer to the vendor's 'Low'. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation probability or availability of weaponized code. Exploitation also requires user interaction (UI:R) - the victim must open attacker-controlled content. Net: treat as a patch-on-normal-cadence browser update rather than an emergency; the Critical CVSS is not corroborated by vendor severity, exploitation data, or POC availability. VERIFY the severity discrepancy with Google before escalating.

An attacker hosts a crafted HTML page and lures an Android Chrome user to visit it (e.g., via phishing link or malicious ad). The page triggers memory corruption in Chrome's WebAppInstalls component, and if successfully exploited, arbitrary code executes outside the browser sandbox on the device. No public exploit code was identified at time of analysis, and user interaction is required for the attack to succeed.