EUVD-2026-91711
GHSA-2m7j-rg95-qgh4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Contextual Tasks
-
ExecutionReclaim freed object to corrupt memory
-
ImpactEscape sandbox and execute code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (e.g., via a prior renderer vulnerability); this flaw is a sandbox-escape primitive, not an initial-access bug. The victim must then load attacker-controlled content (UI:R - a crafted HTML page), and the affected build must be Chrome on Windows prior to 154.0.8037.97. Limiting factors: the prerequisite renderer compromise, the required user interaction, high attack complexity (AC:H) reflecting the memory-grooming needed to exploit the use-after-free reliably, and the Windows-only, version-specific scope. Chrome's default auto-update to 154.0.8037.97 or later fully removes the condition. |
| Impact | Signals point to a genuine but second-stage vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) reflects a scope-changing sandbox escape with total impact, but AC:H and UI:R already encode significant hurdles. Critically, the description states the attacker must have ALREADY compromised the renderer process - so PR:N in the vector is misleading as a standalone measure of effort; this is a sandbox-escape primitive that presupposes a prior renderer bug. Exploitation signals are all low/negative: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and SSVC reports Exploitation=none and Automatable=no, while Technical Impact=total. The combination (total impact but not automatable, no observed exploitation, low EPSS) is internally consistent: this is a high-value but complex component in a multi-stage exploit chain, not a mass-exploitable remote hole. No public POC is referenced in the input. Net: a real patch-priority item for any Chrome fleet due to full code execution outside the sandbox, but not an actively-exploited drop-everything event at time of analysis. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer-level bug to run code inside Chrome's renderer sandbox, then lures the victim to a crafted HTML page that triggers the use-after-free in the Contextual Tasks component. Freeing and reclaiming the object lets the attacker corrupt memory to break out of the sandbox and execute arbitrary code on the Windows host. High attack complexity (AC:H) and required user interaction (UI:R) make this a chained, targeted operation rather than a point-and-click exploit; no public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
A use-after-free flaw in Chrome's Contextual Tasks component on Windows lets an attacker who has already compromised the renderer process break out of the browser sandbox and execute arbitrary code with the browser's privileges, triggered when the victim loads a crafted HTML page. Only Chrome builds on Windows prior to 154.0.8037.97 are affected, and exploitation is not an initial-access path: it requires a pre-existing renderer compromise plus user interaction, which is why the CVSS 3.1 base score of 8.3 reflects high attack complexity (AC:H). No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), with CISA SSVC rating exploitation as 'none' and automatable as 'no'; Google has shipped a vendor patch in version 154.0.8037.97, and Chrome's default auto-update resolves the exposure.
RemediationAI
Vendor-released patch: Chrome 154.0.8037.97, available via the Chrome stable channel update (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html); upgrade to 154.0.8037.97 or later and confirm the version in chrome://version, restarting the browser so pending updates are applied since Chrome's default auto-update and relaunch is the primary control. Because this is a second-stage sandbox-escape primitive rather than an initial-access bug, the prerequisite is an existing renderer compromise, so hardening should also focus on reducing renderer exploitation opportunities: keep the site isolation and sandbox features enabled (do not launch with --no-sandbox or disable site isolation, which would remove the boundary this escape targets at the cost of eliminating defense in depth), restrict or disable Contextual Tasks via the relevant enterprise policy if the feature is not required (accepting loss of that functionality for users), and disable or tightly control JavaScript/JIT-heavy untrusted content through enterprise policy for high-risk users where feasible (with the trade-off of breaking legitimate web applications). Track the upstream issue https://issues.chromium.org/issues/561660166 for backports and any updated guidance; until patching completes on managed fleets, treat unpatched Windows Chrome as a lower-tier risk that only becomes exploitable after a separate renderer bug is chained.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-416 use-after-free in the Contextual Tasks feature of the Chromium codebase, meaning a heap object is freed and then dereferenced again, allowing attacker-influenced memory to be reinterpreted as a live object. Within Chrome's multi-process architecture, the renderer is the untrusted, sandboxed process; a UAF that is reachable and groomable in that context can be turned into a corrupted object that the browser (privileged) process subsequently acts upon, producing a sandbox escape rather than a simple crash. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H encodes a network-delivered attack requiring no credentials, high attack complexity consistent with reliable heap grooming, mandatory victim interaction (loading the crafted page), and a scope change because execution crosses the renderer-to-browser trust boundary to gain code execution outside the sandbox with high confidentiality, integrity, and availability impact. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped by the vendor and EUVD data to Chrome 154.0.8037.97 builds and earlier on Windows.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H and UI:R capture the required prior renderer compromise, memory grooming, and victim page visit; S:C reflects crossing the sandbox boundary to the host with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Windows versions prior to 154.0.8037.97 carries a high-severity sandbox-escape vulnerability that could let an attacker who already controls the browser's renderer process execute code with the browser's privileges. No public exploit identified at time of analysis, and exploitation requires a pre-existing renderer compromise plus user interaction, so the immediate organizational risk is concentrated in unpatched Windows endpoints with weakened or disabled auto-update. Vendor-released patch: 154.0.8037.97 is available, and normal Chrome auto-update should resolve the exposure once devices receive it.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB