EUVD-2026-93603
GHSA-pc7p-jj4x-56rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page with malicious font
-
ExploitVictim visits page in Chrome
-
ExecutionTrigger incorrect comparison in font handling
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect comparison
|
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content (a crafted HTML page containing a malicious font) in Google Chrome versions prior to 155.0.8059.39; this user interaction (UI:R - visiting the page) is the primary limiting factor. No authentication or special privileges are required (PR:N), and no non-default configuration is needed - Chrome's font rendering is a core, always-active component. The decisive mitigating limit is that resulting code execution is CONFINED TO THE RENDERER SANDBOX (per the description and S:U); escaping to the host requires a separate, unrelated sandbox-escape vulnerability, which is why Chromium rated the severity Low despite the high CVSS. |
| Impact | Signals conflict sharply and must be weighed together. The provided CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, implying easy remote unauthenticated code execution. However, Google/Chromium rated this security severity 'Low', and the description explicitly states code execution occurs 'inside the sandbox' - meaning a separate sandbox-escape bug would be required for full host compromise, which materially lowers real-world impact versus the raw 8.8. The SSVC framework reinforces lower urgency: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (requires per-victim user interaction, consistent with UI:R), though Technical Impact is 'total'. No EPSS score was supplied, and there is no CISA KEV listing and no POC indicator in the input, so exploitation is: no public exploit identified at time of analysis. Net assessment: this is NOT a drop-everything emergency despite the 8.8 figure - the CVSS High rating and the vendor's Low rating diverge because CVSS does not model the sandbox confinement. Patch promptly through normal Chrome update cadence, but the realistic risk is constrained by the required user interaction and the sandbox boundary. Note the conflict explicitly: CVSS says High/8.8 while Chromium severity says Low - the difference is explained by in-sandbox-only code execution. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing a specially crafted font and lures a victim into visiting it (UI:R, AC:L). When Chrome's font handling performs an incorrect comparison (CWE-697), the attacker gains arbitrary code execution confined to the renderer sandbox. No public exploit code is identified at time of analysis, and full system compromise would additionally require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
RemediationAI
Vendor-released patch: upgrade Google Chrome to version 155.0.8059.39 or later; Chrome's automatic update service distributes the fix, but managed environments should verify the installed version via chrome://version or enterprise version reporting and force an update/relaunch if the browser has been running for an extended period, since the update applies on restart. If immediate patching is not possible, keep the renderer sandbox and Site Isolation enabled (both are on by default) - disabling them would convert a sandbox-confined renderer compromise into a host compromise, so they should not be weakened as a workaround. As a temporary compensating control, restrict browsing to trusted sites through enterprise URL allow-listing or run Chrome in a disposable/low-privilege VM, with the trade-off that allow-listing is operationally heavy and prone to false positives that block legitimate business content; blocking web fonts entirely is not a reliable control because it breaks site rendering and can be bypassed by same-origin content. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the Chromium issue at https://issues.chromium.org/issues/513446410 for patch specifics.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-697 (Incorrect Comparison) and resides in Chrome's font handling code, which parses and processes web fonts inside the renderer process. A crafted HTML page referencing a specially formed font triggers a comparison error that can lead to memory corruption and controlled code execution within the renderer. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with a wildcard version indicates the flaw affects the general Chrome product across platforms within the pre-155.0.8059.39 version range, consistent with EUVD-2026-93603 which lists Chrome < 155.0.8059.39. Because font rendering is a core, always-active component with no non-default configuration required, the attack surface is broad; however, the renderer sandbox constrains post-exploitation impact, and Chromium's own Low severity rating reflects that host compromise requires chaining a second, independent bug. SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: total, indicating no observed exploitation and that the attack is not trivially automatable at scale due to the victim-interaction requirement.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no auth (PR:N) but victim must visit it (UI:R); scope unchanged as execution stays in the renderer sandbox, with high impact within that process.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 contain a font-rendering flaw that lets a crafted web page run arbitrary code inside the browser's renderer sandbox, affecting any employee who browses the web with an unpatched instance. Because the code execution is contained within the renderer sandbox and no public exploit has been identified, the practical organizational exposure is limited, but the widespread use of Chrome makes timely remediation worthwhile. A vendor patch is available and should be deployed through existing browser management channels.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB