Google Chrome EUVD-2026-116524

Exploitation requires a user running Google Chrome prior to 157.0.8103.38 to actively load attacker-controlled web content (UI:R), so the victim must visit a crafted HTML/JavaScript page - this user-interaction requirement is the primary limiting factor and prevents fully automated mass exploitation (SSVC Automatable: no). No authentication is required (PR:N) and no non-default configuration is needed; any standard Chrome install processing the malicious page through V8 is affected. A key scope limitation: the description states code execution is confined 'inside the sandbox', so by itself this flaw compromises only the renderer process and would need to be chained with a separate sandbox-escape vulnerability to achieve host-level code execution.

This is a genuine high-priority browser vulnerability but not a drop-everything emergency based on current signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a web page, with total confidentiality/integrity/availability impact. The SSVC framework qualifies this: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (user interaction breaks the drive-by-at-scale model), and Technical Impact is 'total'. The vuln.today Decision label is 'this_week', consistent with a serious but not actively-exploited bug. There is no CISA KEV listing and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. Crucially, the description states code execution occurs 'inside the sandbox' - meaning this V8 type-confusion yields renderer-process compromise, not a confirmed full host takeover, unless chained with a separate sandbox-escape. The CVSS C:H/I:H/A:H reflects severity within the renderer context and does not itself prove host-level compromise. Net: patch on a short timeline (days) as a high-severity RCE in a ubiquitous product, but current evidence points to no known exploitation rather than an in-the-wild emergency.

An attacker hosts or compromises a web page containing malicious JavaScript that triggers the V8 type-confusion flaw; a victim running an unpatched Chrome (before 157.0.8103.38) simply visits the page and attacker-controlled code executes within the renderer sandbox. No public exploit was identified in the provided data, and the specific trigger mechanics are not described in the available sources. Realistic weaponization against a high-value target would typically require chaining this with a separate sandbox-escape bug to reach the underlying OS.