Google Chrome EUVD-2026-116426

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build prior to 157.0.8103.38; the crafted HTML page must execute JavaScript that drives V8 into the type-confusion state (CWE-843). The limiting factors are: mandatory user interaction (UI:R - the victim must visit/render the page), and that code execution is confined to the renderer sandbox per the description, meaning full host compromise additionally requires a separate sandbox-escape not covered by this CVE. No authentication or special privileges are needed (PR:N), and no non-default configuration is required - standard Chrome rendering of a web page is sufficient to reach the vulnerable code. The precise JavaScript trigger sequence is not described in the available sources.

This is a genuinely high-priority browser vulnerability, though the signals are mixed on immediacy. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a remote, low-complexity, unauthenticated (PR:N) attack requiring only that the victim load a crafted HTML page (UI:R), with total confidentiality, integrity and availability impact (C:H/I:H/A:H) - a classic drive-by code-execution profile for a V8 type-confusion (CWE-843) bug. Crucially, the description scopes code execution to 'inside the sandbox,' and the CVSS scope is Unchanged (S:U), so this is renderer-level compromise and would need to be chained with a sandbox-escape to fully own the host. The SSVC framework tempers urgency: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no,' but Technical Impact is 'total,' which aligns with the vuln.today 'this_week' priority rather than an emergency. There is no CISA KEV listing and no EPSS score provided, and no exploit/PoC reference appears in the input - so there is currently no evidence of active exploitation or public exploit code. The signals are therefore consistent rather than conflicting: a high-severity, high-impact memory-corruption bug in an enormously deployed product, patched by the vendor, but without current evidence of in-the-wild use. Treat it as a prompt patch-this-cycle item, not a fire drill. Note the input provides a static CVSS score but no EPSS value, so probabilistic exploitation likelihood cannot be quantified from the available data.

An attacker hosts or compromises a web page containing malicious JavaScript that triggers the V8 type confusion when rendered by a vulnerable Chrome build, and lures a victim to visit it (e.g., via a link or malicious ad). Successful exploitation yields arbitrary code execution within the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape to reach the underlying OS. No public exploit or PoC is identified in the available sources at the time of analysis.