Google Chrome EUVD-2026-111426

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (any version before 156.0.8078.73) - i.e., user interaction (UI:R) in the form of visiting or opening a malicious/compromised page; no authentication and no special browser configuration is needed (default settings are affected). The principal limiting factor is that successful exploitation yields code execution only INSIDE the renderer sandbox (Scope:Unchanged): escaping to the host requires chaining a separate sandbox-escape bug, so this flaw alone does not grant full OS-level compromise. The required navigation/user interaction further constrains fully automated, interaction-free mass exploitation.

This is a genuine high-priority patching item, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction - the victim must visit a crafted HTML page. Chromium rated it Critical, and the CWE-416 use-after-free in Layout is the classic renderer-RCE class that Chrome exploit writers target. Crucially, the description states code execution occurs 'inside the sandbox' (Scope:Unchanged), so this single bug does NOT by itself yield full host compromise - it would need to be chained with a separate sandbox escape to become a complete exploit, which meaningfully lowers standalone real-world impact. No EPSS score, no KEV listing, and no PoC are present in the input, so there is no signal of active or imminent exploitation; the only exploitation evidence is the restricted Chromium issue tracker entry. The vendor priority label is 'this_week', consistent with a patched critical renderer bug that should be rolled out promptly but is not under confirmed attack. Signals are internally consistent: nothing here conflicts, but the sandbox-contained impact is the key nuance that raw 8.8 obscures.

An attacker hosts or compromises a web page containing malicious HTML that triggers the use-after-free in Chrome's Layout engine; when a victim using a version prior to 156.0.8078.73 browses to it, the attacker achieves arbitrary code execution within the renderer sandbox. Because execution is confined to the sandbox, a practical full-system compromise would additionally require a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data.