Google Chrome EUVD-2026-116502

Exploitation requires the victim to use Google Chrome on Android at a version prior to 157.0.8103.38 and to visit or be redirected to an attacker-controlled crafted HTML page that exercises the Dawn (WebGPU) component - the CVSS UI:R metric confirms required user interaction. No authentication or elevated privileges are needed (PR:N), and the attack is network-delivered (AV:N). The principal limiting factors are the mandatory user interaction (the page must actually be opened) and the Android-specific, pre-157.0.8103.38 version constraint; the precise content needed to trigger the heap overflow is not described in the available sources beyond 'a crafted HTML page.'

This is a genuine high priority, not an inflated high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw that only requires the victim to view a crafted HTML page, and the scope change (S:C) plus the description's 'execute arbitrary code outside the sandbox' indicate a renderer-to-host sandbox escape - the most severe class of browser bug. The SSVC framework agrees on impact (Technical Impact: total) and the vuln.today decision label is act_now, so remediation should be treated as urgent. However, the signals are not uniform: SSVC lists Exploitation as none and Automatable as no, no CISA KEV entry is present, and no EPSS probability was supplied, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' The one chromium issue-tracker reference (issues.chromium.org/issues/569161611) is a vendor bug record, not verified working exploit code. In short: severity and patch urgency are high and vendor-confirmed, but the exploitation-in-the-wild signals are currently absent, so the urgency is driven by impact and automatability of patching rather than by observed attacks. EPSS is missing and should be checked before final prioritization.

An attacker hosts or injects a malicious web page that drives the Dawn (WebGPU) component; when an Android Chrome user before 157.0.8103.38 opens the page, the crafted content triggers a heap buffer overflow that can lead to arbitrary code execution outside the browser sandbox. Exploitation requires user interaction (visiting the page) but no authentication or special privileges. No public, verified exploit code has been identified at the time of analysis.