Google Chrome EUVD-2026-116423

Exploitation requires a victim using Google Chrome before version 157.0.8103.38 to actively load attacker-controlled crafted HTML (UI:R - visiting a malicious or compromised page); it is remote and unauthenticated (PR:N) but cannot occur without this user interaction, which is the primary limiting factor and is consistent with SSVC Automatable=no. The resulting code execution is confined to the renderer sandbox (S:U, 'inside the sandbox' per the description), so a full host compromise additionally requires chaining with a separate sandbox-escape vulnerability - a significant practical limit on standalone impact. No special non-default configuration is called out in the sources; the flaw affects default Chrome builds prior to the fixed version.

This is a genuinely high-priority memory-corruption flaw, though the signals are internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remote, low-complexity, unauthenticated attack that requires user interaction (victim must visit a crafted HTML page) and yields total technical impact (C:H/I:H/A:H). The SSVC framework aligns with this but tempers urgency: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with UI:R - it cannot be sprayed without luring users), Technical Impact=total. The vuln.today decision label is 'this_week' rather than act_now/emergency, matching the 'no exploitation yet' posture. Critically, the description scopes code execution to 'inside the sandbox' (S:U, no scope change), so this is NOT a confirmed full-system compromise on its own - it would typically need to be chained with a sandbox-escape bug to reach the host. No EPSS score and no KEV listing were provided, and no PoC/exploit reference is present, so exploitation probability cannot be quantified from the input. Net: a real, patch-this-week browser RCE (sandbox-contained) with total in-sandbox impact, but no evidence of active exploitation or available exploit code at time of analysis.

An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Modularization component; a victim running a pre-157.0.8103.38 build simply visits the page (the required user interaction) and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code or PoC reference was provided in the input, and SSVC reports no observed exploitation. To affect the host, the attacker would need to chain this with a separate sandbox-escape vulnerability.