Google Chrome EUVD-2026-116413

Exploitation requires a victim using an unpatched Chrome build prior to 157.0.8103.38 to actively load attacker-controlled content - the crafted HTML page must reach the browser's printing functionality to trigger the use-after-free (UI:R). The attacker needs no authentication or prior privileges (PR:N) and the page is served over the network (AV:N). Key limiting factors: successful code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so it is not by itself a host takeover and would need to be chained with a sandbox escape for full system impact; the required user interaction (navigating to the malicious page) prevents reliable unattended mass exploitation, consistent with SSVC Automatable 'no'. The exact markup or print-flow sequence needed to trigger the free-then-use is not detailed in the available sources.

This is a genuinely high-severity but not emergency-tier issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted HTML page). All three signals that would escalate urgency are currently negative or absent: SSVC reports Exploitation 'none' (no observed or public exploitation) and Automatable 'no' (user interaction breaks reliable mass automation), KEV status is not present in the input (not CISA-listed), and no EPSS probability was supplied. SSVC Technical Impact 'total' is consistent with arbitrary code execution. These signals are coherent rather than conflicting: high theoretical impact, but no evidence of real-world exploitation and a user-interaction gate that limits scalability. One important scoping nuance - the description states code execution occurs 'inside the sandbox,' i.e. this is renderer-process compromise and NOT a confirmed sandbox escape (S:U reflects this), so standalone impact on the host is contingent on chaining with a separate sandbox-escape bug. The vuln.today priority of 'this_week' aligns with this profile: patch promptly, but it is not an active-exploitation emergency. No EPSS score was provided, so widespread-exploitation likelihood cannot be quantified from the input.

An attacker hosts or compromises a web page containing malicious markup that triggers the printing code path in Chrome; a victim with an unpatched browser (prior to 157.0.8103.38) visits the page and the use-after-free is triggered, yielding arbitrary code execution within the renderer sandbox. No public exploit code is identified in the provided sources, and because user interaction (visiting the page) is required and execution is confined to the sandbox, a full host compromise would require chaining with an additional sandbox-escape vulnerability.