EUVD-2026-93843
GHSA-qgq7-9f49-wxv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryPage JavaScript manipulates WebRTC objects
-
ExploitTrigger use-after-free in WebRTC
-
ExecutionGroom heap and reclaim freed object
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Chrome's WebRTC functionality path reachable from a crafted HTML page and to actively visit attacker-controlled or compromised content (UI:R) - no authentication is required (PR:N) and default Chrome configurations are affected since WebRTC is a standard built-in component. The primary limiting factors are: (1) user interaction is mandatory (the victim must open the malicious page), and (2) code execution is confined to the renderer sandbox per the description, so real-world host compromise additionally requires chaining a separate sandbox-escape vulnerability. Versions at or above 155.0.8059.39 are patched and not exploitable. |
| Impact | Multiple signals converge on a genuinely high-priority but not emergency issue. CVSS 3.1 is 8.8 with AV:N/AC:L/PR:N/UI:R, meaning remote, low-complexity, unauthenticated exploitation requiring only that a victim visit a crafted page - the classic drive-by browser RCE profile, with C:H/I:H/A:H (total technical impact, matching SSVC's 'Technical Impact: total'). However, countervailing signals temper urgency: SSVC records Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit (POC) is indicated in the input - so this is no public exploit identified at time of analysis, not active exploitation. The impact is further bounded because the description explicitly states code execution occurs 'inside the sandbox,' so a successful exploit yields renderer-process compromise rather than full host takeover absent a chained sandbox escape - the CVSS C:H/I:H/A:H reflects worst-case impact within the sandboxed scope (S:U). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored. Net: a real priority to patch promptly given Chrome's ubiquity and the ease of the attack vector, but currently theoretical rather than demonstrably exploited, and single-bug impact is sandbox-confined. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML and JavaScript that drives Chrome's WebRTC subsystem into a use-after-free state. When a victim simply visits the page (UI:R), the freed object is reclaimed and manipulated to achieve arbitrary code execution within the renderer sandbox. No POC is indicated in the provided data, and low attack complexity (AC:L) means no special timing or environmental conditions are needed once the victim loads the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Google Chrome versions prior to 155.0.8059.39 contain a use-after-free in the WebRTC component that a remote, unauthenticated attacker can trigger by convincing a victim to visit a crafted HTML page, resulting in arbitrary code execution within the renderer sandbox (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not automatable and requires user interaction, and the resulting code execution is confined to Chrome's renderer sandbox per the vendor description, so full host compromise would additionally require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no known exploitation; Chrome's built-in auto-update is the primary exposure-reduction control, as patched versions 155.0.8059.39 and later are not vulnerable.
RemediationAI
Vendor-released patch: 155.0.8059.39 - upgrade Google Chrome to 155.0.8059.39 or later, as documented in the Chrome Releases stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html) and tracked upstream at https://issues.chromium.org/issues/567160162. The most reliable path is to allow Chrome's built-in auto-update to complete and then fully restart the browser (a restart is required for renderer-side fixes to take effect), verifying the running build via chrome://version; in managed fleets, push the update through the enterprise update policy or your software deployment system and confirm version compliance. If immediate patching is not possible, compensating controls are limited because WebRTC cannot be fully disabled via a single supported Chrome policy - practical options include restricting browsing to trusted/allow-listed sites and applying URL-filtering or network egress controls to reduce the chance a user loads attacker-crafted HTML, deploying an extension or enterprise policy that constrains WebRTC transport (for example limiting WebRTC UDP port ranges), which may break legitimate video conferencing and real-time communication applications, and ensuring the renderer sandbox remains enabled and unweakened so that a successful trigger is contained rather than escalated to host code execution. Note that a successful in-sandbox exploit still depends on the user opening the malicious page, so user awareness and phishing-resistant browsing controls provide secondary risk reduction but should not be treated as a substitute for upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's WebRTC implementation - the browser-native stack providing peer connections, media capture/transport, data channels, and ICE/STUN/TURN handling. WebRTC is a large, threading-heavy C++ subsystem in which native objects are shared across network, worker, and renderer threads; lifetime and reference-counting errors in this code class typically allow a freed heap object to be dereferenced under attacker-influenced timing, corrupting heap metadata or redirecting control flow to attacker-controlled data. Because WebRTC is a standard, always-present component in default Google Chrome installations (CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), no non-default feature flag is needed to reach the vulnerable path, though the attack still requires the target to load attacker-controlled or compromised web content (UI:R) and is remote and unauthenticated (PR:N). The chromium security severity is rated High, and public tags associate the CVE with RCE, memory corruption, and denial-of-service outcomes. EUVD entry EUVD-2026-93843 mirrors the affected range as Chrome releases below 155.0.8059.39, with the corresponding upstream bug tracked as Chromium issue 567160162.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N), no privileges (PR:N) but victim must visit (UI:R); use-after-free yields full code execution confined to the renderer sandbox, so S:U with C/I/A all High.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 contain a high-severity use-after-free in WebRTC that allows a remote, unauthenticated attacker to achieve code execution inside the browser's renderer sandbox if a user visits a crafted page; no public exploit identified at time of analysis. Because the flaw requires user interaction and is confined to the sandbox, full host compromise would require chaining a separate sandbox escape, but any unpatched browser in the workforce remains an exposed attack surface. Leadership should ensure all Chrome endpoints are updated promptly to reduce organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB