Google Chrome EUVD-2026-111451

Exploitation requires the victim to open an attacker-controlled HTML page in Google Chrome prior to version 156.0.8078.73 (UI:R - user interaction is mandatory, which is the primary limiting factor). No authentication is required against the browser (PR:N) and the attack is remote (AV:N) with low complexity (AC:L); it works against default Chrome configurations because V8 JavaScript execution is enabled by default. The significant containment factor is that code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so full host compromise would additionally require a separate sandbox-escape vulnerability not covered by this CVE. No special non-default feature or configuration setting is named in the sources.

This is a genuine high-priority browser vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution that requires user interaction - the victim must load a crafted HTML page. Google rates the Chromium severity as High. The key tempering factor is explicit in the description: arbitrary code execution occurs 'inside the sandbox' (S:U, no scope change), so a successful V8 memory-corruption exploit yields control of the renderer process, not the host, unless chained with a separate sandbox-escape - a factor the raw 8.8 does not convey. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed as CISA KEV in the supplied data, and no public exploit or PoC reference is present (the references are vendor/aggregator advisories only). The vuln.today decision label is 'this_week', consistent with a patched, high-severity, user-interaction-gated browser bug rather than active mass exploitation. Net: patch within the vendor's/decision-framework's this-week window; this is a real priority driven by Chrome's ubiquity and the RCE class, not a low-real-risk high-CVSS artifact, but there is no evidence of active exploitation at time of analysis.

An attacker hosts or compromises a web page containing crafted content that triggers the V8 memory-corruption flaw, then lures a Chrome user (versions before 156.0.8078.73) to visit it - e.g. via a phishing link or a malicious ad. When the page's JavaScript is processed by V8, the memory corruption is triggered and the attacker potentially executes arbitrary code within the renderer sandbox. No public exploit code is identified in the available sources, and the specific trigger mechanism is not described.