Google Chrome EUVD-2026-116291

Exploitation requires a victim running Google Chrome prior to 157.0.8103.38 to actively load attacker-controlled content - specifically a crafted HTML page that drives the browser's Media component into processing malformed media, triggering the out-of-bounds read. Required user interaction (UI:R - the victim must navigate to the page) is the primary limiting factor, as is the sandbox boundary: the description states code execution would occur 'inside the sandbox,' so by itself this flaw does not yield host-level compromise without a separate sandbox-escape. The exact trigger mechanism within the Media component is not described in the available sources beyond the crafted-HTML-page vector.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction - consistent with a drive-by web exploit where a victim merely visits a crafted HTML page. Two signals pull in opposite directions and should be reconciled before prioritization: NVD/CVSS rates this High (8.8), while Google's own Chromium team labeled the security severity Medium, and the description explicitly scopes code execution to 'inside the sandbox' (S:U, no sandbox escape), which caps real-world impact well below a full renderer-to-host compromise. The underlying weakness is CWE-125 (out-of-bounds read), typically a memory-disclosure primitive; the 'potentially execute arbitrary code' wording is conditional, not confirmed. No EPSS score, no CISA KEV listing, and no verified public exploit were provided, so there is no evidence of active or imminent mass exploitation. Net: this is a legitimately patch-worthy browser bug (ubiquitous product, remote vector, minimal interaction) but the sandbox-confined impact, Chromium's Medium rating, and absence of exploitation signals argue against emergency treatment - matching the input's 'this_week' decision label rather than act_now.

An attacker hosts or compromises a web page containing crafted media content and lures a user running Chrome prior to 157.0.8103.38 to visit it (e.g., via a link or malicious ad). When Chrome's Media component processes the content, an out-of-bounds read is triggered that could leak memory or, per the vendor, potentially lead to code execution confined to the renderer sandbox. No public exploit was identified at the time of analysis, and user interaction (visiting the page) is required.