Google Chrome EUVD-2026-105751

Exploitation requires a victim running a vulnerable Google Chrome desktop build (any version prior to 156.0.8078.47) to actively load a crafted HTML page controlled by the attacker - this required user interaction (UI:R) is the primary limiting factor, since the flaw cannot be triggered without the victim navigating to malicious content. No authentication is required (PR:N) and no special Chrome configuration is needed; default configurations are affected. The critical containment limit is that code execution is confined to the renderer sandbox (S:U) - meaningful host compromise additionally requires a separate sandbox-escape vulnerability that this CVE does not provide.

Signals conflict, and that conflict is the headline. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields an 8.8 'High', describing low-complexity, unauthenticated, network-reachable code execution requiring only that a victim open a crafted page. However, Google/Chromium rated the security severity 'Low', and the description is explicit that code execution occurs INSIDE the renderer sandbox - the attacker gains control of a sandboxed process, not the host. This is why scope is Unchanged (S:U): without a separate sandbox-escape bug, impact is confined to the compromised renderer and the web content it can reach. EPSS is not provided, so exploitation probability cannot be quantified. The CVE is not in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net: a real, patch-worthy browser flaw to remediate via normal Chrome auto-update cadence, but the 8.8 overstates standalone real-world severity - sandbox containment, the vendor's own 'Low' rating, and the absence of KEV/POC/EPSS all point to lower practical priority than the number suggests. Treat as High only if chained with a sandbox escape.

An attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption flaw when rendered by a vulnerable Chrome version (prior to 156.0.8078.47). A victim who browses to the page has attacker-controlled code executed within Chrome's renderer sandbox, giving the attacker control of that process and the web data it handles. No public proof-of-concept or exploit code is referenced, and the attack does not by itself escape the sandbox to reach the host.