Google Chrome EUVD-2026-116501

Exploitation requires the victim to open an attacker-crafted HTML page in Google Chrome prior to 157.0.8103.38, triggering a use-after-free in the Prerender component; the CVSS vector's UI:R confirms user interaction (navigation to the malicious page) is the key limiting factor. No authentication is required (PR:N) and the attack is remote (AV:N), so it works against default Chrome configurations where the user can be enticed to load content, but it is NOT a zero-click flaw - it depends on that navigation. The precise internal trigger within Prerender is not described in the available sources beyond the use-after-free classification. The scope change (S:C) reflects escape from the renderer sandbox to the host, which materially raises impact versus an in-sandbox-only bug.

This is a genuine high-priority issue, not a high-CVSS/low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (visiting a page), and the scope change (S:C) is consistent with the description's explicit claim of code execution OUTSIDE the Chrome sandbox - a sandbox escape, which is the most severe class of browser bug. SSVC reinforces severity on technical impact (Total) but reports Exploitation: none and Automatable: no, meaning CISA's framework sees no evidence of active exploitation yet. There is a tension in the signals: the vuln.today Decision label is act_now and Chromium rates it Critical, yet SSVC exploitation is none, there is no CISA KEV listing, and no EPSS score is provided - so the urgency here is driven by severity and patch availability rather than by confirmed in-the-wild activity. No EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the input. Net: treat as act_now for patch deployment given ubiquity of Chrome and a Critical sandbox-escape, while noting that active exploitation is NOT confirmed by any source in this data.

An attacker hosts a crafted HTML page and lures a victim to open it in a vulnerable Chrome build (prior to 157.0.8103.38); the page drives the Prerender feature into a use-after-free condition. Because the flaw yields code execution outside the sandbox, successful exploitation can compromise the host beyond the browser renderer. No public exploit is identified in the provided data, and exploitation requires the victim to load the attacker-controlled page (UI:R).