Google Chrome EUVD-2026-116384

Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to load an attacker-controlled HTML page containing crafted WebGL content (the required user interaction per UI:R). The specific trigger is an out-of-bounds write in Chrome's WebGL implementation; the precise malformed-input mechanism is not detailed in the available sources beyond 'crafted HTML page.' Limiting factors: exploitation is not automatable (SSVC Automatable: no) because it depends on luring a user to the malicious page, and it is constrained to the Android platform and to unpatched versions; WebGL must be reachable in the rendering context. No authentication is required (PR:N). The decisive mitigation stated by the vendor is updating to 156.0.8078.47 or later.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C, 9.6) describes a remotely reachable, low-complexity, no-privilege memory-corruption flaw whose scope change (S:C) reflects the stated sandbox escape - a WebGL out-of-bounds write (CWE-787) that executes arbitrary code OUTSIDE the Chrome sandbox, which is among the most severe outcomes for a browser. The vuln.today Decision label is act_now and the patch is available, so remediation should not be deferred. However, the exploitation signals are more nuanced than the severity: CISA SSVC lists Exploitation as 'none' (no observed or public exploitation), Automatable 'no' (requires a victim to visit a crafted page, consistent with UI:R), and Technical Impact 'total' (consistent with full code execution). The CVE is NOT in CISA KEV, and no EPSS score was supplied, so the real-world exploitation PROBABILITY cannot be quantified from the provided data. The two Google references are a release blog and a Chromium issue tracker entry (the latter is typically access-restricted), not working exploit code. Net: the technical impact and reachability justify urgent patching, but there is currently no evidence of active exploitation - the urgency is driven by the critical sandbox-escape impact and act_now label, not by confirmed in-the-wild activity. The 'Automatable: no' and UI:R signals indicate exploitation requires user interaction, which slightly tempers mass-scanning risk relative to a zero-click flaw.

An attacker hosts or compromises a web page containing malicious WebGL/HTML content and lures an Android Chrome user (prior to 156.0.8078.47) to visit it, for example via a phishing link or a malvertising frame. Rendering the crafted content triggers the out-of-bounds write in WebGL, corrupting memory to achieve arbitrary code execution outside the browser sandbox on the device. No public exploit code is identified in the provided data, and SSVC lists exploitation as 'none'; successful attack requires the victim to load the page (UI:R).