Google Chrome EUVD-2026-116329

Exploitation requires social engineering plus victim interaction (UI:R): the target must be induced to open an attacker-crafted HTML page and perform the needed interaction, with Chrome DevTools functionality involved in exposing the resource. The critical limiting factor is containment - code execution occurs inside the Chrome renderer sandbox, not on the host, so impact is confined absent a separate sandbox-escape; this is why Chromium rated it Low despite the 8.8 input score. No authentication is required (PR:N), and default Chrome configurations on versions prior to 157.0.8103.38 are affected. The specific DevTools configuration or user action that triggers the resource exposure is not detailed in the available sources.

Signals conflict sharply and must be reconciled before prioritizing. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) treats this as near-critical, yet Google/Chromium independently rated the security severity 'Low', and SSVC reports Exploitation: none and Automatable: no (only Technical Impact: total). The reason for the gap is in the description: code execution is achieved 'inside the sandbox,' i.e. contained within Chrome's renderer sandbox rather than a full sandbox escape to the host, so the real-world impact is far narrower than the C:H/I:H/A:H triad implies. Exploitation also requires a remote attacker 'leveraging social engineering' plus user interaction (UI:R), which lowers automatability and scale. There is no CISA KEV listing (SSVC Exploitation: none) and no public exploit identified at time of analysis; one reference points to issues.chromium.org/553161888, which is typically access-restricted and is not a verified working exploit. EPSS was not provided. Net: this is a vendor-labelled Low-severity, patch-available issue whose headline 8.8 overstates urgency; the vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with routine patch-cycle handling. Treat as a standard Chrome update rather than an emergency, while noting the CVSS-vs-vendor-severity discrepancy should be verified against the Chrome release notes.

A remote attacker crafts a malicious HTML page and, via social engineering, lures a victim into opening it and taking the interaction the attack requires (UI:R), abusing improper resource exposure in Chrome DevTools to run attacker-controlled code within the renderer sandbox. The exact trigger mechanism is not described in the available sources. No public exploit identified at time of analysis; a restricted Chromium issue tracker reference exists but is not verified as working exploit code.