Google Chrome EUVD-2026-105769

Exploitation requires an attacker to get a victim to load a crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) that exercises the Bookmarks component to trigger the use-after-free - the UI:R metric reflects this mandatory victim interaction (visiting/rendering the page). The key LIMITING factor is that resulting code execution is confined to the renderer sandbox, so a successful exploit yields only sandboxed execution; achieving OS-level compromise requires chaining a separate sandbox-escape vulnerability. Chrome's automatic update mechanism also narrows the exposure window once the stable channel update is distributed.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, which is why it rates HIGH on paper. However, three signals temper the real-world urgency. First, Google's own Chromium triage rated the security severity as LOW, which conflicts with the 8.8 CVSS and is a meaningful contradiction worth noting. Second, the description explicitly states code executes 'inside the sandbox' - this is a renderer-level use-after-free (CWE-416), not a full host compromise; an attacker would still need a separate sandbox-escape chain to achieve code execution on the underlying OS, which the CVSS S:U (scope unchanged) is consistent with. Third, there is no EPSS score provided, no CISA KEV listing, and no public exploit (POC) identified, so there is no evidence of active or imminent exploitation. Net assessment: this is a legitimately patchable browser RCE primitive in an ubiquitous product, but the LOW vendor severity plus the sandbox confinement and absence of exploitation signals make it a routine 'patch in the normal Chrome auto-update cycle' item rather than an emergency. Note the explicit conflict: CVSS HIGH (8.8) versus Chromium 'Low' severity - defenders should weight the vendor's sandbox-confinement context.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that manipulates Chrome's Bookmarks component to trigger a use-after-free. When a victim simply visits the page (UI:R), the freed-then-reused memory is leveraged to execute attacker-controlled code within the renderer sandbox. No authentication is required (PR:N), but the attacker gains only sandboxed execution and would need an additional sandbox-escape bug for full host compromise; no public exploit code is currently identified.