Google Chrome EUVD-2026-116408

Exploitation requires a victim using Google Chrome prior to 157.0.8103.38 to actively open an attacker-controlled crafted HTML page (UI:R), after which the use-after-free in the Animation component can be triggered with no authentication (PR:N) and low complexity (AC:L). The primary limiting factors are: (1) mandatory user interaction - the victim must navigate to the malicious page, which prevents fully automated/wormable mass exploitation (SSVC Automatable=no); (2) the resulting arbitrary code execution is confined to the renderer sandbox per the description, so escaping to the host requires chaining a separate sandbox-escape bug; and (3) only pre-157.0.8103.38 builds are affected, so environments with auto-update current are not exposed.

This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, consistent with a drive-by browser bug triggered by visiting a crafted page. Critically, the description states code execution occurs 'inside the sandbox,' so the scope is unchanged (S:U) and full host compromise would still require a separate sandbox escape - this meaningfully tempers real-world impact versus the raw 8.8. The decision signals point the same way: SSVC reports Exploitation=none, Automatable=no (user interaction defeats mass automation), and Technical Impact=total, and the vuln.today priority is 'this_week' rather than act_now/emergency. There is no CISA KEV listing and no public exploit identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a missing signal. Net: a High-severity memory-corruption bug worth patching on a normal expedited cycle, not a confirmed actively-exploited crisis.

An attacker hosts or compromises a web page containing crafted HTML/JavaScript that manipulates Chrome's Animation component to trigger a use-after-free, then lures a victim running a version prior to 157.0.8103.38 to visit it. Low attack complexity and no required privileges make the trigger reliable once the user loads the page, but the victim must actively navigate to the content (UI:R) and the resulting code execution is confined to the renderer sandbox. No public exploit identified at time of analysis.