A vulnerability analyst is scoring a newly disclosed flaw in an internet-facing web application. The vulnerability can be exploited by an unauthenticated remote attacker sending a crafted HTTP request, requires no user interaction, and results in full compromise of confidentiality, integrity, and availability of the application. Which CVSS v3.1 Base metric assignment most accurately reflects that the attack can be launched from anywhere on the internet without local or adjacent access?