Google Chrome EUVD-2026-116407

Exploitation requires a victim using a vulnerable Chrome build (prior to 157.0.8103.38) to navigate to attacker-controlled content - a crafted HTML page (UI:R, user interaction required); no authentication and no non-default configuration are needed (PR:N against default browser settings). The principal limiting factors are: (1) the required user interaction of visiting/opening the malicious page, and (2) the CVSS Unchanged scope and the description's 'inside the sandbox' wording, meaning code execution is confined to the renderer/V8 sandbox and does not by itself escape to the host - full system compromise would require an additional chained sandbox-escape vulnerability. The exact trigger conditions within V8 are not described in the available sources.

This is a genuine high-priority browser vulnerability, though the available signals are mixed rather than uniformly alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a trivially met condition for a consumer web browser. CWE-843 type confusion in V8 is a classic, high-value RCE primitive. Countering that, the SSVC framework reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no EPSS score was supplied; the vuln.today priority is 'this_week' (not act_now/emergency), so this should be patched promptly on a normal expedited cycle rather than treated as an active-incident emergency. Technical Impact is rated 'total,' consistent with arbitrary code execution. One important nuance from the description: execution occurs 'inside the sandbox' and the CVSS scope is Unchanged (S:U) - i.e., this grants code execution in the renderer process, not a confirmed sandbox escape, so full host compromise would require chaining with an additional sandbox-escape bug. No EPSS value was provided, so widespread-exploitation probability cannot be quantified from this data.

An attacker hosts or compromises a web page containing a crafted script that triggers the V8 type-confusion flaw; a victim running a vulnerable Chrome build simply visits the page and the attacker gains arbitrary code execution within the browser's renderer sandbox. No public exploit is identified in the supplied data, and the specific trigger mechanics are not described in the available sources. Because scope is Unchanged, the attacker would typically need a second sandbox-escape vulnerability to reach the host OS.