Google Chrome EUVD-2026-116389

Exploitation requires the victim to load attacker-controlled content: a crafted HTML page rendered by a vulnerable Chrome build prior to 157.0.8103.38 (UI:R). No authentication or prior privileges are needed (PR:N), and it works against default Chrome configurations since Layout rendering is core browser functionality - no special feature or non-default setting must be enabled. The principal limiting factors are the required user interaction (the attacker must get each victim to open the malicious page, so exploitation is not automatable per SSVC) and the impact boundary: code execution is confined to the renderer sandbox, so full host compromise additionally requires a separate sandbox-escape vulnerability. Updating to 157.0.8103.38 or later is the vendor's fix.

This is a genuine high-priority browser vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw needing no privileges but requiring user interaction - a victim must open a crafted HTML page. SSVC signals temper the urgency: Exploitation is 'none' (no observed exploitation), Automatable is 'no' (consistent with UI:R, since the attacker must lure each victim), while Technical Impact is 'total' (consistent with a use-after-free yielding arbitrary code execution). The vulnerability is NOT in CISA KEV and no EPSS score was supplied, so widespread opportunistic exploitation is not currently evidenced. No public exploit identified at time of analysis - the only references are the vendor's Chrome release blog and the restricted Chromium issue tracker entry (568832157), which is typically access-limited until broad patch uptake. The vuln.today Decision label is 'this_week', aligning with a patch-promptly posture rather than drop-everything. Note the impact ceiling: Chrome reports code execution 'inside the sandbox', so this single bug does not by itself yield host compromise and would need to be chained with a sandbox-escape for full system takeover - a material limiter on real-world severity that the raw 8.8 does not convey.

An attacker hosts or compromises a web page containing HTML crafted to trigger the use-after-free in Chrome's Layout engine, then lures a victim to visit it (UI:R). When the victim's browser renders the page, the freed object is reused, giving the attacker arbitrary code execution within the renderer sandbox. No public exploit code is identified at this time; exploitation requires both victim interaction and, for full host compromise, chaining with a separate sandbox escape.