Google Chrome EUVD-2026-113438

Exploitation requires the victim to open or be navigated to attacker-controlled crafted HTML in Chrome (UI:R user interaction), with no authentication and no special account privileges (PR:N); it is remotely reachable over the network (AV:N) with low complexity (AC:L). The affected scope is Google Chrome prior to 156.0.8078.79. Key limiting factor: the description states code execution occurs 'inside the sandbox' (consistent with S:U), so successful exploitation yields renderer-level compromise only - breaking out to the host requires chaining a separate sandbox-escape vulnerability. The requirement for user interaction (visiting a page) and the sandbox confinement are the principal constraints that reduce realistic impact below the raw score; no non-default configuration is indicated, so default Chrome installs below the fixed version are affected. Per the vendor, updating to 156.0.8078.79 or later is the remedy.

Signals are mostly consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects a network-reachable, low-complexity, unauthenticated renderer-side code-execution flaw that only requires the victim to open a crafted page. Against that, the real-world exploitation signals are low: EPSS is 0.20% (10th percentile), the CVE is NOT in CISA KEV, and the SSVC framework records Exploitation: none and Automatable: no, while rating Technical Impact as total. These agree that active or mass exploitation is not currently observed, which matches the vuln.today 'this_week' priority rather than an act_now/emergency label. One nuance the raw 8.8 obscures: the description states code execution occurs 'inside the sandbox,' so by itself this yields only renderer compromise - full host compromise requires chaining a separate sandbox-escape bug, something the CVSS scope-unchanged (S:U) metric is consistent with. The UI:R requirement (user must visit attacker content) further limits automatability, consistent with SSVC Automatable: no. Net: a genuine priority because of Chrome's ubiquity and the total technical impact within the renderer, but current evidence indicates no public exploitation, so it warrants prompt patching this week rather than crisis response. No key signals are in hard conflict; the main caveat is that the sandbox confinement means the practical severity for a fully patched, sandbox-intact deployment is lower than the 8.8 score suggests in isolation.

A remote attacker hosts or injects a crafted HTML page and lures a victim into visiting it (UI:R); when Chrome's Blink engine renders it, a use-after-free (CWE-416) is triggered, letting the attacker execute arbitrary code within the renderer sandbox. Because low attack complexity and no authentication are required (AC:L/PR:N), delivery via a malicious link, ad, or compromised site is realistic. No public exploit identified at time of analysis; the linked Chromium issue tracker entry is access-restricted and the fix was reported internally by Chrome.