Google Chrome EUVD-2026-113436

Exploitation requires an attacker to get a victim using an affected Chrome build (prior to 156.0.8078.79) to render attacker-controlled HTML - i.e. visit a malicious or compromised web page (UI:R in the CVSS vector). No authentication or prior privileges are needed (PR:N), and no special victim-side configuration is indicated; default Chrome configurations are affected. The principal limiting factors are: (1) mandatory user interaction (the victim must load the page), which blocks fully automated/wormable spread and is consistent with SSVC Automatable: no; and (2) the description places code execution 'inside the sandbox', so by itself this yields only renderer-process compromise - host-level impact additionally requires a separate sandbox-escape vulnerability.

Signals here point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw that still requires user interaction - the victim must load a crafted HTML page - with high confidentiality, integrity and availability impact (C:H/I:H/A:H). Google rates the Chromium severity High. However, the exploitation-pressure signals are low: EPSS is only 0.20% (10th percentile), the SSVC framework reports Exploitation: none and Automatable: no (consistent with requiring a user to visit a page rather than mass worm-style spread), and there is no CISA KEV listing. SSVC Technical Impact: total aligns with the total-impact CVSS triad and the 'execute arbitrary code' description. The one notable caveat is that the description explicitly says code execution occurs 'inside the sandbox' - i.e. this is a renderer-process compromise, not a confirmed sandbox escape, so real-world impact normally requires chaining with a separate sandbox-escape bug to reach the host. The vuln.today priority is 'this_week', which matches a high-severity, patch-available browser RCE with no active exploitation: important to roll out promptly, but not an act_now/emergency item. Net: a real priority for patch deployment, but current data indicates no widespread or automated exploitation.

An attacker hosts or compromises a web page containing malicious HTML that triggers the DOM memory-corruption flaw when rendered by a vulnerable Chrome build, and lures a victim to visit it (UI:R). Successful exploitation corrupts memory in the renderer and can lead to arbitrary code execution within the browser sandbox. No public exploit code has been identified at the time of analysis, and reaching beyond the sandbox would require an additional escape.