EUVD-2026-93763
GHSA-vrw5-rxm3-c55f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted HTML/media content
-
ExploitTrigger out-of-bounds write in Media
-
ExecutionCorrupt memory to escape sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Chrome prior to 155.0.8059.39 to open an attacker-controlled HTML page containing crafted media content (UI:R) - there is no drive-by-without-interaction path, so social engineering or a compromised/malicious site is the delivery prerequisite. No authentication is required (PR:N) and the attack is fully remote (AV:N) against default configurations, as the Media component is enabled by default. The principal limiting factor is the mandatory user interaction of visiting malicious content; additionally, achieving the described code execution 'outside the sandbox' requires defeating Chrome's process sandbox, raising real-world exploitation difficulty beyond the AC:L rating. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw whose scope change (S:C) reflects a sandbox escape - the description explicitly states code can execute 'outside the sandbox,' which is what drives the 9.6 score. There is a notable signal conflict: Google's own Chromium severity rating is 'Medium,' while the CVSS base score is Critical (9.6); the elevated CVSS is largely a product of the S:C sandbox-escape modeling, so defenders should treat the sandbox-escape claim as the key risk driver rather than assuming Google under-rated it. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code was identified, so there is no public exploit identified at time of analysis - this is a patch-driven disclosure rather than an actively-exploited emergency. The only mitigating factor in the vector is UI:R: a victim must open attacker-controlled web content. Given Chrome's ubiquity and the low attack complexity, this warrants prompt patching even absent confirmed exploitation. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted media content and lures a victim running a vulnerable Chrome build to visit it (e.g., via phishing or a malvertising redirect). The crafted media triggers an out-of-bounds write (CWE-787) in Chrome's Media component, which the attacker leverages to execute arbitrary code outside the browser sandbox on the victim's host. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
An out-of-bounds write in the Media component of Google Chrome before 155.0.8059.39 lets a remote attacker corrupt memory and potentially achieve arbitrary code execution outside the browser sandbox when a victim opens an attacker-crafted HTML page containing malicious media content. The attack is fully remote and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is gated by user interaction (UI:R) - the victim must visit the malicious or compromised page - and the 'outside the sandbox' outcome implies defeating Chrome's process sandbox, which is materially harder in practice than the 9.6 base score suggests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later (the fixed stable-channel build referenced in Google's release note at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html); on managed endpoints, force the update through Chrome Browser Cloud Management, your MSI/DEB/RPM patch pipeline, or the platform's native updater, and confirm the running build via chrome://version, remembering that a browser restart is required before the fix takes effect. Chromium-based derivatives and embedded Chromium runtimes require their own vendor-supplied builds and should be patched on the same timeline rather than assumed fixed. There is no practical feature-level workaround, since the Media stack is enabled by default and core to normal browsing - disabling media playback or, worse, disabling the sandbox or Site Isolation would break functionality or remove critical defence-in-depth and must not be done. Compensating controls that meaningfully reduce exposure in the interim include URL/domain filtering and DNS-layer blocking so users are less likely to reach attacker-controlled pages, restricting high-risk browsing to trusted sites, ensuring SmartScreen/reputation and Site Isolation remain enabled, and monitoring endpoints for repeated unexpected browser renderer crashes, which can indicate exploitation attempts; each of these lowers the probability of a successful lure but does not remove the underlying flaw, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-787 (Out-of-bounds Write), a memory-corruption class in which a length or index calculation in a parser or decoder writes past the end of an allocated buffer, typically leading to heap corruption and, with sufficient control over the adjacent data, arbitrary code execution. The affected subsystem is Chrome's Media stack - the parsing, demuxing and decoding pipeline for audio/video content - which processes untrusted, attacker-supplied media inside a renderer/utility process; because the description states code execution occurs 'outside the sandbox', a successful chain presumably pairs the memory-corruption primitive with a means of escaping the Chrome sandbox, which is why the assessed vector carries S:C with C:H/I:H/A:H. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) identifies Google Chrome generally, across platforms, as affected up to the fixed build, and the same code is shared with downstream Chromium-based browsers, so those products should be treated as inheriting the flaw until their vendors publish their own fixed versions. Notably, Google rates the issue only 'Medium' under its own Chromium security severity scale even though the evaluated CVSS base score is 9.6; no additional preconditions beyond the user opening the crafted page are described.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N), but victim must visit it (UI:R); sandbox escape changes scope (S:C) with full host code execution impact (C:H/I:H/A:H).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 contain a critical memory-corruption flaw in the browser's media handling that a remote attacker could use to run code on an endpoint beyond the browser's own protective sandbox. Because Chrome is broadly deployed across the workforce, any unpatched device represents an exposure point, though successful abuse requires a user to first visit a malicious or compromised web page. Leadership should treat this as a time-bound patch-management priority rather than an active incident, as no exploitation has been observed and the vendor fix is already available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB