Google Chrome EUVD-2026-111462

Exploitation requires a user running Google Chrome on Windows at a version prior to 156.0.8078.73 to actively open an attacker-crafted HTML page (UI:R); no authentication or prior privileges are needed (PR:N). The primary limiting factors are the required user interaction (the victim must be induced to visit the malicious page) and the Windows-only scope stated in the description; the flaw additionally must achieve a sandbox escape to realize code execution outside the browser's renderer. The specific input-validation condition in the Views component that triggers the flaw is not detailed in the available sources.

Signals point in two directions and must be weighed together. The CVSS 3.1 score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is driven by a network attack vector, low complexity, no privileges, and a scope change reflecting a sandbox escape that yields full confidentiality, integrity, and availability impact on the host - a genuinely serious class of Chrome flaw. The vuln.today Decision label is act_now, and a vendor patch is available, so the recommended posture is to update promptly rather than defer. However, the EPSS probability is only 0.22% (13th percentile), indicating no model-predicted near-term mass exploitation; this is a notable contrast to the 9.6 severity and the act_now label. There is no CISA KEV listing (status: no public exploit identified at time of analysis) and no public exploit identified at time of analysis - the Chromium issue-tracker reference is a restricted bug entry, not verified working exploit code. The one factor that materially reduces practical risk is UI:R: a victim must actively visit a crafted HTML page, so this is not wormable/unauthenticated-remote against a service. Net: treat as a high-priority patch because of the sandbox-escape severity, ubiquitous Chrome footprint, and act_now label, while recognizing that current exploitation evidence is absent and EPSS is low, consistent with an unexploited-but-dangerous browser bug rather than an actively weaponized one.

An attacker hosts a crafted HTML page and lures a user running a vulnerable Chrome build (prior to 156.0.8078.73) on Windows to open it; the page triggers improper input validation in the Views component. Because the CVSS scope is changed, successful exploitation escapes the browser sandbox and can execute arbitrary code on the host with the privileges of the browser process. No public exploit has been identified, and UI:R means the victim must actively navigate to the attacker-controlled page.