Google Chrome EUVD-2026-116512

Requires a victim using an affected Google Chrome desktop build prior to 157.0.8103.38 to load attacker-controlled content - the crafted HTML page (UI:R, user interaction required). No authentication and no non-default configuration is needed; the flaw is in the standard CacheStorage component reachable by any web page. The primary limiting factors are: (1) the required user interaction of visiting/rendering the malicious page, and (2) that code execution is confined to the renderer sandbox, so weaponization for host-level compromise requires chaining with a separate sandbox-escape vulnerability.

This is a genuine priority but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the classic browser drive-by profile. Exploitation status: no public exploit identified at time of analysis; the input provides no EPSS score, no POC flag, and no CISA KEV listing, so there is no signal of active or widespread exploitation yet. The vuln.today decision label is 'this_week', consistent with a High-severity (not Critical) Chromium issue that is patched but not known-exploited. One important nuance from the description: arbitrary code execution occurs 'inside the sandbox' (scope Unchanged, S:U), meaning a successful exploit yields code execution within the renderer sandbox rather than full host compromise - a realistic full attack would require chaining this with a separate sandbox-escape bug. EPSS is missing rather than low, so probability cannot be quantified; treat absence of KEV/POC as 'no evidence yet,' not as proof of low risk, given Chrome's exposure and history of such bugs being weaponized after disclosure.

An attacker hosts or compromises a web page containing malicious JavaScript/HTML that triggers the CacheStorage type confusion when a victim visits it. The memory corruption lets the attacker run arbitrary code within the renderer sandbox. No public exploit code is identified at time of analysis, and full host compromise would require a further sandbox escape.