Google Chrome EUVD-2026-111436

Exploitation requires the victim to load attacker-controlled content - a crafted HTML page - in a vulnerable Google Chrome desktop build prior to 156.0.8078.73 (UI:R); there is no drive-by or server-side vector, so some user interaction is mandatory. No authentication or prior privileges are needed (PR:N). A key limiting factor: the description states code execution occurs 'inside the sandbox' with CVSS scope Unchanged, so by itself the flaw does not escape Chrome's renderer sandbox - full host compromise would require chaining a separate sandbox-escape bug. Exploitation is further limited to users who have not applied the 156.0.8078.73 stable update. The precise malformed-input condition in Skia that triggers the flaw is not described in the available sources.

Signals are moderately consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes remote, low-complexity, unauthenticated (PR:N) code execution that nonetheless requires user interaction (UI:R) - the victim must open a crafted HTML page. Crucially, the description states code executes 'inside the sandbox' and the CVSS scope is Unchanged (S:U), so this is a renderer-level compromise, not a confirmed full sandbox escape; absent a chained escape, impact is contained by Chrome's sandbox, which tempers real-world severity. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a high-severity but non-actively-exploited browser bug. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is not demonstrated. Chromium rates the security severity High. Net: a genuine high priority for Chrome fleets given ubiquity and RCE potential, but the required user interaction, sandbox confinement, and absence of exploitation evidence place it below drop-everything urgency. EPSS is missing - exploitation probability cannot be quantified from the input.

An attacker hosts or compromises a web page containing malformed graphics content that triggers the Skia input-validation flaw, then lures a victim running a pre-156.0.8078.73 Chrome build to visit it (UI:R). When the page renders, the crafted input corrupts renderer memory and can lead to arbitrary code execution, though confined to the browser sandbox. No public exploit code was identified at time of analysis.