Google Chrome EUVD-2026-113437

Exploitation requires a victim using Google Chrome prior to 156.0.8078.79 to navigate to an attacker-controlled or attacker-injected HTML page crafted to trigger the integer overflow in the Editing component; per CVSS PR:N no authentication is needed and it works against default configurations, but UI:R means the victim must actively load the malicious page - there is no server-side or zero-click path described. The key limiting factor is that, per the vendor, resulting code execution is confined to the Chromium sandbox, so full host compromise would require chaining an additional sandbox-escape vulnerability. The specific overflow trigger beyond 'a crafted HTML page' is not described in the available sources.

Signals point to a genuinely serious browser flaw but not a top-of-queue emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated bug requiring one user action (visiting a page), with high impact on confidentiality, integrity and availability. SSVC tempers this: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (user interaction breaks mass automation), while Technical Impact is 'total'. EPSS agrees it is not currently a widespread-exploitation concern - 0.20% (10th percentile) is low. There is no CISA KEV listing and no confirmed public PoC, so this is a high-severity, high-impact issue whose real-world exploitation likelihood is presently low, consistent with the vuln.today 'this_week' priority rather than 'act_now'/'emergency'. One important nuance from the description that the CVSS score does not capture: code execution is stated to occur INSIDE the Chromium sandbox, so by itself this does not yield host compromise without a separate sandbox-escape chain - the 8.8 reflects in-sandbox impact, and defenders should weigh that containment when prioritizing.

An attacker hosts or compromises a web page containing crafted HTML that triggers the integer overflow in Chrome's Editing component when rendered; a victim is lured into visiting it. Successful triggering allows the attacker to potentially execute arbitrary code within the browser's renderer sandbox. No public exploit code has been identified at time of analysis, and user interaction (navigating to the page) is required.