Google Chrome EUVD-2026-111456

Exploitation requires the victim to use an unpatched Chrome build (prior to 156.0.8078.73) and to actively visit or be redirected to an attacker-controlled page serving crafted content - the CVSS UI:R and the phrase 'via a crafted HTML page' confirm required user interaction (page visit), which is the primary limiting factor; no authentication is required (PR:N). A further key limit is that successful exploitation yields code execution only 'inside the sandbox' (S:U), so standalone impact is confined to the renderer process and does not by itself compromise the host without an additional sandbox-escape vulnerability. The specific Video-component configuration or media format needed to reach the vulnerable code path is not described in the available sources.

Signals conflict in a way worth stating plainly. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) and Chromium's own 'High' severity rating indicate a serious, remotely-reachable memory-corruption flaw triggered simply by rendering a page, with high confidentiality, integrity and availability impact. Against that, the EPSS probability is only 0.22% (13th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with the low EPSS and absence of in-the-wild activity. A critical mechanistic caveat tempers the raw score: the description states the flaw allows code execution 'inside the sandbox' (scope unchanged, S:U), so by itself it does NOT grant host compromise - it would need to be chained with a separate sandbox-escape bug to become full RCE on the machine. Net: this is a legitimate, patch-promptly browser vulnerability driven by ubiquitous deployment and the trivially-remote trigger, not a drop-everything emergency. The high CVSS reflects worst-case in-sandbox impact; real-world urgency is moderated by low EPSS, no KEV, no known exploit, and the sandbox containment.

An attacker hosts or compromises a web page containing crafted media/video content and lures a Chrome user (versions prior to 156.0.8078.73) into visiting it; rendering the page triggers a use-after-free in the Video component that the attacker leverages to execute arbitrary code within the browser's renderer sandbox. No public exploit code has been identified at time of analysis, and full host compromise would additionally require chaining a separate sandbox escape.