Google Chrome EUVD-2026-116499

Exploitation requires a victim using a vulnerable Chrome build (prior to 157.0.8103.38) to load an attacker-crafted HTML page that triggers the memory-corruption bug in ANGLE, Chrome's default graphics backend; no authentication and no special non-default configuration is indicated (PR:N against default ANGLE rendering). The limiting factor is the required user interaction (UI:R) - the attacker cannot trigger the flaw without the victim navigating to the malicious page - which is why SSVC marks the issue as not automatable. The precise trigger within ANGLE is not described in the available sources. Note the unresolved platform scope (description says Android; vendor reference is the desktop channel).

This is a genuine high priority, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw in ANGLE (Chrome's graphics abstraction layer) that escapes the renderer sandbox - the scope change (S:C) is consistent with the description's 'execute arbitrary code outside the sandbox.' The only brake is UI:R: a victim must load a crafted page. The signals are internally consistent but point to potential rather than observed risk: SSVC records Exploitation: none, Automatable: no (aligned with the required user interaction), and Technical Impact: total. There is no CISA KEV listing and no POC/exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not provided, so probabilistic exploitation likelihood cannot be weighed. Despite no evidence of active exploitation, the vuln.today Decision label is act_now - justified by a critical full-impact sandbox escape in a ubiquitously deployed browser where patch cycles are the primary defense. One data conflict to verify: the description states 'on Android' while the sole vendor reference is the Chrome 'Stable Channel Update for Desktop' blog and the CPE is the generic google:chrome - confirm the affected platform(s) with Google before scoping remediation.

An attacker hosts a web page containing content crafted to trigger the ANGLE memory-corruption condition when Chrome renders it. A victim running a vulnerable Chrome build (prior to 157.0.8103.38) visits the page, and the attacker potentially achieves arbitrary code execution outside the renderer sandbox. No public exploit was identified at time of analysis, and exploitation requires the victim to navigate to the attacker-controlled page.