Google Chrome EUVD-2026-116299

Exploitation requires a victim running Google Chrome prior to 157.0.8103.38 to visit or open an attacker-controlled crafted HTML page (UI:R), after which malicious JavaScript triggers the V8 type confusion; no authentication or elevated privileges are needed (PR:N) and default Chrome configurations are affected. Key limiting factors: the victim must take the action of loading the page (so it is not zero-click or wormable), and the resulting arbitrary code execution is confined to the renderer sandbox per the description - obtaining host-level compromise would require an additional, separate sandbox-escape vulnerability that this CVE does not provide.

Multiple signals must be weighed carefully. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a remotely reachable, low-complexity flaw needing no privileges, which looks high-priority on its face. However, two signals temper this: (1) the description states code executes 'inside the sandbox,' meaning this V8 type-confusion bug yields renderer-process code execution only - full host compromise would require chaining a separate sandbox-escape, which is not described here; and (2) Google's own Chromium severity rating is Medium, notably lower than the NVD-style 8.8, reflecting the sandbox containment. UI:R also means a user must actively open attacker-controlled content, so this is not wormable zero-click. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, so there is no confirmed active-exploitation signal; there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week,' consistent with a patched, high-reach browser bug that warrants prompt rollout but is not flagged as an emergency. Net assessment: a genuine priority for Chrome fleets because of the product's ubiquity and the ease of luring users to a page, but the Medium Chromium rating and sandbox limitation argue against treating it as a drop-everything emergency absent an exploit or KEV listing.

An attacker hosts or compromises a web page containing crafted JavaScript that triggers the V8 type-confusion flaw when a victim using a vulnerable Chrome build (before 157.0.8103.38) visits it. Successful exploitation gives the attacker arbitrary code execution within the renderer sandbox; achieving control of the host would require an additional sandbox escape not covered by this CVE. No public exploit code was identified in the provided sources.