Google Chrome EUVD-2026-116420

Exploitation requires the victim to load attacker-controlled web content - a crafted HTML page - in Chrome (UI:R), with no authentication or prior privileges (PR:N). The decisive limiting factor is that successful exploitation yields code execution only INSIDE the Chrome renderer sandbox (scope Unchanged); converting this into full host compromise requires chaining a separate sandbox-escape vulnerability not covered by this CVE. Affected: Chrome versions prior to 157.0.8103.38; updating to 157.0.8103.38 or later is the fix.

This is a genuine high-priority patching item, though several signals sharpen the picture. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a trivially met condition for a web browser. CWE-416 (use-after-free) in the Paint component is a classic memory-corruption primitive that routinely yields code execution. The vuln.today decision label is 'this_week', consistent with a Google-rated High (not Critical) renderer bug. A crucial limiting nuance: the description states code executes 'inside the sandbox' and the scope is Unchanged (S:U), meaning this alone compromises only the renderer process - full host compromise would require chaining a separate sandbox-escape bug, which is not part of this CVE. No CISA KEV listing is present in the input, so there is no evidence of active exploitation. No EPSS score was provided, so exploitation probability cannot be quantified from this data. No proof-of-concept or working exploit is indicated (the chromium issue link is a restricted bug-tracker reference, not published exploit code). In short: high-severity and eminently patchable, but not confirmed as actively exploited or widely weaponized from the available signals, and its real-world blast radius is bounded by the sandbox absent a second vulnerability.

An attacker hosts a malicious web page (or injects malicious content into a page the victim visits) that drives Chrome's Paint code path to free and then reuse an object, corrupting memory. When the victim browses to the page, the use-after-free is triggered and arbitrary code runs within the Chrome renderer sandbox. No public exploit identified at time of analysis; achieving impact beyond the renderer would require an additional sandbox-escape vulnerability.