Google Chrome EUVD-2026-116295

Exploitation requires a user running Chrome prior to 157.0.8103.38 to be socially engineered into visiting an attacker-crafted HTML page that exercises the Autofill component (UI:R) - this user-interaction requirement is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and the attack is network-delivered against affected Chrome desktop builds; the specific Autofill feature state or configuration needed to reach the vulnerable code is not described in the available sources. The affected population is bounded to Chrome versions below the fixed 157.0.8103.38 build.

Signals conflict and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only barrier is user interaction, and whose scope change (S:C) reflects the described sandbox escape - on paper a critical issue. However, Google's own Chromium severity rating is Medium, a notable downgrade from the 9.6 base score, and the SSVC framework records Exploitation: none and Automatable: no (Technical Impact: total). There is no CISA KEV listing and no EPSS probability was supplied, and the references (Chrome release blog plus a Chromium issue tracker entry, which is typically access-restricted) do not constitute public exploit code. So although the vuln.today Decision label is act_now and a patch is available, the real-world exploitation evidence is currently absent: this looks like a high-CVSS, patch-promptly issue rather than one with demonstrated active exploitation. The divergence between the 9.6 CVSS and the vendor's Medium rating should be verified against Google's advisory; the 'outside the sandbox' wording is what drives the high score, but the trigger mechanism beyond 'use after free in Autofill via a crafted HTML page' is not described in the available sources.

An attacker crafts a malicious HTML page that exercises the Autofill component and, through social engineering, lures a victim running a vulnerable Chrome build into visiting it, triggering a use-after-free that could execute arbitrary code outside the renderer sandbox. The attack requires the victim to interact with attacker-controlled content (UI:R) but needs no authentication (PR:N). No public exploit has been identified at time of analysis.