Google Chrome EUVD-2026-116409

Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process (this is a sandbox-escape primitive, not an initial-access bug), plus the victim must load attacker-crafted HTML that is processed by the Skia graphics library to trigger the out-of-bounds read - reflected by UI:R in the CVSS vector. Limiting factors that reduce realistic risk: the mandatory prior renderer compromise (typically a separate chained vulnerability), high attack complexity (AC:H), the requirement for user interaction (loading the crafted page), and the need to be running a Chrome version prior to 157.0.8103.38. Affects default Chrome configurations once the renderer stage is achieved; updating to 157.0.8103.38 or later is the vendor's fix.

The signals point to a genuine but non-emergency priority. The CVSS 3.1 base score is 8.3 (High) with a network vector (AV:N), but high attack complexity (AC:H), required user interaction (UI:R) and a scope change (S:C) reflecting the sandbox escape. Crucially, the description states the attacker must have ALREADY compromised the renderer process, so this is a second-stage sandbox-escape primitive rather than a standalone remote exploit - the network/PR:N framing understates the real precondition. The SSVC decision framework reports Exploitation: none, Automatable: no, Technical Impact: total, which aligns with a powerful-but-hard-to-reach bug. The vuln.today Decision label is 'this_week', so it should be remediated promptly but is not flagged act_now/emergency. No CISA KEV listing is present (not actively exploited per available data) and no EPSS score was provided in the input, so exploitation probability cannot be quantified - this is a data gap. No public exploit or PoC reference is included. In short: a high-impact (total technical impact) sandbox escape in ubiquitous software, but gated behind a prior renderer compromise, high complexity and user interaction, with no evidence of exploitation - a real priority to patch this week, not a drop-everything emergency.

An attacker who has already gained code execution in Chrome's renderer process (via a separate renderer bug) lures or directs the victim to load a crafted HTML page that drives the Skia graphics library into an out-of-bounds read. By leveraging the OOB read, the attacker escalates from the constrained renderer sandbox to arbitrary code execution on the host outside the sandbox. No public exploit identified at time of analysis; the bug was reported internally by Chrome.