Google Chrome EUVD-2026-113422

Exploitation requires the victim to open an attacker-crafted HTML page in Chrome prior to 156.0.8078.79 (CVSS UI:R confirms required user interaction), with no authentication needed (PR:N). The flaw is in the FileSystem component; the specific API usage or configuration that drives it into the use-after-free state is not described in the available sources. The key limiting factor is that successful exploitation yields code execution only INSIDE the renderer sandbox (scope unchanged, S:U) as the description explicitly states - meaningful host compromise would require chaining a separate sandbox-escape vulnerability. Automatable is 'no' per SSVC, so each victim must be individually delivered and must open the page.

Signals are moderately consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no privileges but requiring the victim to open a crafted HTML page; the High rating reflects full confidentiality/integrity/availability impact, and the unchanged scope (S:U) is consistent with the description's explicit statement that code executes 'inside the sandbox' rather than escaping it. SSVC reinforces this: Technical Impact is 'total' (full control of the affected component), but Exploitation is 'none' and Automatable is 'no', meaning no observed exploitation and no reliable mass-automation path - a crafted page must be delivered and opened per victim. EPSS is low at 0.24% (15th percentile), the CVE is NOT on CISA KEV, and no public exploit or PoC reference is provided, so there is no confirmed-exploitation or public-exploit-code signal to contradict the low EPSS. The vuln.today priority of 'this_week' is coherent with that picture: a real, patchable high-severity browser RCE worth prompt patching, but not an active-exploitation emergency. No signals are in direct conflict; the main caveat is that this is a sandbox-confined renderer compromise, so standalone real-world impact depends on chaining with a separate sandbox-escape bug.

An attacker hosts or injects a crafted HTML page that drives the Chrome FileSystem component into a use-after-free state, then lures a user to open it (malvertising, phishing link, or compromised site). When the freed object is reused, the attacker gains arbitrary code execution within the renderer sandbox. No public exploit or PoC has been identified at time of analysis, and the attacker-controlled trigger mechanics beyond 'crafted HTML page' are not detailed in the available sources.