Google EUVD-2026-13461

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker can deliver the malicious HTML via email, website, or messaging. No special Chrome configuration required.

Despite the absence of CVSS score and EPSS data in the provided metadata, this vulnerability presents critical real-world risk for several reasons: (1) the attack vector is network-based with low complexity (crafted HTML), (2) exploitation results in arbitrary code execution within a sandboxed process, (3) Google assigned 'High' severity classification indicating internal risk assessment supports criticality, (4) a patch is available from the vendor indicating the issue was substantiated, and (5) the EUVD tracking and Debian distribution flags indicate widespread impact across enterprise and consumer deployments. The absence of KEV status and POC information in provided data does not diminish risk—this is a recent CVE (2026) with limited public disclosure timeline. Organizations should treat this as high-priority based on the sandbox escape capability and network attack surface, regardless of CVSS numerical scores.

An attacker crafts a malicious HTML page containing specially crafted JavaScript code that triggers a flaw in V8's JIT compilation or memory management. When a victim user visits this page via Chrome prior to 146.0.7680.153, the crafted JavaScript executes and exploits the sandbox boundary violation, allowing the attacker's code to break out of the sandbox isolation layer and execute arbitrary code with the privileges of the Chrome renderer process. This could lead to data theft, malware installation, or lateral movement to the host system depending on the exploit sophistication.