Google Chrome EUVD-2026-50756

Exploitation requires the victim to open or be directed to an attacker-controlled crafted HTML/JavaScript page in an unpatched Chrome build (below 151.0.7922.72) - user interaction is mandatory (CVSS UI:R), so there is no drive-by-without-visit vector. Limiting factors: code execution is confined to the renderer sandbox (description states 'inside a sandbox', CVSS S:U), so standalone impact does not include host takeover without an additional sandbox-escape chain; no authentication is required (PR:N) and no special browser configuration or non-default feature is needed. The primary constraints on real-world exploitation are the required user interaction and the sandbox containment, not authentication or configuration.

Signals are mixed and should be weighed together rather than by CVSS alone. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects network reach with low complexity and no privileges, but User Interaction is Required (UI:R) - the victim must visit or be lured to a malicious page - and Scope is Unchanged (S:U), consistent with the description's statement that code runs only 'inside a sandbox.' The EPSS score is low (0.21%, 12th percentile), the Chromium security severity is Medium (not High/Critical), and the issue is not on CISA KEV, with no public exploit identified at time of analysis. These lower-priority signals contrast with the high 8.8 base score: the S:U/'inside a sandbox' constraint means this bug alone does not yield host compromise without a chained sandbox escape, which materially reduces real-world risk versus the raw number. Net assessment: a genuine issue worth patching in the normal Chrome auto-update cycle, but not an emergency; the CVSS 8.8 somewhat overstates standalone impact given the sandbox containment explicitly noted by the vendor.

An attacker hosts a malicious web page containing crafted JavaScript that triggers the V8 use-after-free, or injects it via a malvertising frame on a legitimate site, and lures a victim to load it. When the victim's unpatched Chrome renders the page, the dangling-pointer corruption lets the attacker execute code within the renderer sandbox; to reach the host, they would then need to chain a separate sandbox-escape vulnerability. No public exploit is identified at time of analysis.