Google Chrome EUVD-2026-113424

Exploitation requires an attacker to deliver a crafted HTML page and the victim to visit/render it (UI:R in the CVSS vector), so this is not a zero-click flaw - user interaction is the primary limiting factor. The affected component is the CacheStorage subsystem in Chrome versions prior to 156.0.8078.79; running a patched build removes exposure. No authentication is required (PR:N). The impact is bounded to reading memory (C:L; I:N/A:N), so there is no confirmed code execution or availability impact from this issue alone. The specific configuration or page content that triggers the corruption is not described in the available sources.

This is a moderate, not high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is a partial loss of confidentiality (C:L) - consistent with the description, which states an attacker can read memory, not corrupt execution flow or crash the process. All real-world signals align downward: EPSS is 0.20% (9th percentile), the vulnerability is NOT in CISA KEV, and the SSVC decision framework reports Exploitation: none, Automatable: no, Technical Impact: partial. The vuln.today priority is 'this_month', not act_now or emergency. Chromium labels the security severity 'High', but that reflects browser-internal triage of a memory-safety bug class, not confirmed exploitability; the quantitative signals (EPSS, SSVC, absence of KEV) indicate low probability of widespread exploitation. The chief caveat: Chromium rates this High while the NVD CVSS is only 4.3 - this gap is expected because the CVSS impact is limited to an information read (C:L), whereas Chromium weights memory-corruption primitives that could be chained. Treat as a routine patch-cycle item unless combined with other Chrome vulnerabilities.

A remote attacker hosts a crafted HTML page and lures a victim into visiting it (user interaction required). When the page exercises the CacheStorage code path, it triggers the memory-corruption condition and allows the attacker to read portions of browser process memory, potentially disclosing sensitive data from other sites or the process. Low attack complexity, but no public exploit has been identified and the leak is a partial confidentiality impact only.