Google Chrome EUVD-2026-111448

Exploitation requires a victim to load attacker-controlled HTML in a vulnerable Chrome build (any version prior to 156.0.8078.73) - this user interaction (UI:R, navigating to a crafted page) is the primary limiting factor; there is no authentication requirement (PR:N) and no special non-default configuration is needed, as the Paint rendering component is core browser functionality. The decisive limit on impact is that successful exploitation yields code execution only inside the renderer sandbox, so full system compromise additionally requires a separate sandbox-escape vulnerability. Updating to 156.0.8078.73 or later removes the flaw.

This is a genuine priority, though its real-world severity is bounded by an important nuance in the description. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remotely reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the classic drive-by browser profile. However, the description explicitly scopes the outcome to 'execute arbitrary code inside the sandbox,' meaning this grants code execution only within the Chrome renderer process; full host compromise would require chaining a separate sandbox-escape bug, a limit the raw 8.8 does not convey (and consistent with S:U). Exploitation status: no public exploit identified at time of analysis - the CVE is not in CISA KEV and no PoC/exploit reference is supplied (the issues.chromium.org link is a tracker entry, typically access-restricted, not working exploit code). No EPSS score was provided, so statistical exploitation likelihood cannot be assessed here. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a patched, high-severity renderer UAF that is not yet known to be exploited. Use-after-free in a browser (CWE-416) is a historically heavily weaponized bug class, so despite the absence of current exploitation signals, prompt patching within the stated window is warranted.

An attacker hosts or compromises a web page containing malicious markup/scripting that drives Chrome's Paint component into a use-after-free state; when a victim simply visits the page, the attacker achieves arbitrary code execution within the renderer sandbox. No authentication is needed and complexity is low, but the user must navigate to the page (UI:R) and the attacker gains only sandboxed execution unless paired with a sandbox escape. No public exploit code is identified at this time.