Google Chrome EUVD-2026-111452

Exploitation requires the victim to load attacker-controlled web content - a crafted HTML page - in a Chrome build prior to 156.0.8078.73 (UI:R). No authentication or prior privileges are needed (PR:N). The key limiting factors: (1) user interaction is mandatory, so purely passive or automated mass exploitation is less straightforward; (2) impact is confined to the renderer sandbox (scope Unchanged, description states code runs 'inside the sandbox'), meaning full host takeover would require chaining a separate sandbox-escape vulnerability. Updating Chrome to 156.0.8078.73 or later is the vendor-provided fix.

This is a genuine priority but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction - the victim must load attacker-controlled web content. Two signals temper the raw score: scope is Unchanged and the description explicitly states code executes 'inside the sandbox,' so this alone does not yield host compromise without a separate sandbox-escape bug. The vendor's own priority label is 'this_week,' consistent with a High (not Critical) Chromium rating. No EPSS score, no CISA KEV listing, and no proof-of-concept were supplied, so exploitation probability and in-the-wild activity cannot be quantified from this data. Exploitation status: no public exploit identified at time of analysis. The combination (ubiquitous product, unauthenticated network vector, user interaction needed, sandbox-confined impact, patch already shipped) makes prompt patching clearly warranted without implying active mass exploitation.

An attacker hosts a crafted HTML page (or injects it via a malvertising/compromised-site vector) and lures a Chrome user to visit it. Improper input validation in the ReadingList component is triggered by the page, potentially letting the attacker run arbitrary code within the renderer sandbox. No proof-of-concept or exploit code was provided in the available sources.