Google Chrome EUVD-2026-116439

Exploitation requires the victim to open an attacker-crafted HTML page in Google Chrome prior to 157.0.8103.38 (UI:R - active user interaction such as visiting a malicious or compromised web page). No authentication is required (PR:N) and no non-default configuration is needed - default Chrome installations are affected. The principal limiting factors are: (1) the required user interaction, which prevents fully automatic, worm-like spread (SSVC Automatable: no); and (2) the fact that arbitrary code execution is confined to the renderer sandbox, so a full host compromise additionally requires chaining a separate sandbox-escape vulnerability.

This is a genuine high-priority browser vulnerability, though the signals are mixed on immediacy. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is that the victim must open attacker-controlled content - a trivially satisfiable condition for a web browser. Technical impact is total (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating and the use-after-free (CWE-416) class. However, several signals temper raw urgency: SSVC records Exploitation as 'none' (no observed exploitation or public PoC) and Automatable as 'no' (exploitation is not trivially scalable because it depends on luring users), the CVE is NOT in CISA KEV, and no EPSS score was supplied. The vendor-assigned priority is 'this_week' rather than act_now/emergency. One important qualifier from the description: the code executes 'inside the sandbox' - this is a renderer-level compromise, not a confirmed full sandbox escape, which is why Scope is Unchanged (S:U); real-world severity depends on chaining with a separate sandbox-escape bug. Net: patch promptly within the vendor's this_week window, but there is no evidence of active exploitation at time of analysis.

An attacker hosts or injects a crafted HTML page (e.g., via a malicious site, compromised ad, or link) and lures a user running a Chrome version prior to 157.0.8103.38 to visit it. The page triggers the use-after-free in the Controls component, corrupting memory to achieve arbitrary code execution within the renderer sandbox. No public exploit code was identified at time of analysis; a Chromium issue-tracker reference exists but is not verified working exploit code.