EUVD-2026-100631
GHSA-f6f7-wvpm-x8rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious media content
-
ExploitTrigger use-after-free in Media component
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to visit or load an attacker-controlled crafted HTML page containing malicious media content that triggers the Media component use-after-free - this user-interaction requirement (UI:R) is the primary limiting factor. No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected; however, resulting code execution is confined to the renderer sandbox (S:U), so a separate sandbox-escape vulnerability would be required to compromise the underlying host. Affects Chrome versions prior to 155.0.8059.79. |
| Impact | This is a genuinely serious client-side vulnerability but not a top-tier emergency based on the available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms network-reachable, low-complexity, unauthenticated exploitation that nonetheless requires user interaction (UI:R) - the victim must load a crafted HTML page. Chromium rates the security severity as Critical, while the CVSS base score is 8.8 (High), the gap reflecting that code execution occurs inside the renderer sandbox (scope unchanged, S:U) rather than achieving full host compromise. Exploitation signals are currently reassuring: CISA's SSVC decision framework lists Exploitation as 'none' and Automatable as 'no' (consistent with the UI:R requirement), though Technical Impact is 'total'. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. EPSS was not provided in the input and cannot be cited. Net assessment: patch promptly given the ubiquity of Chrome and the memory-corruption class (UAF, CWE-416), but there is no evidence of in-the-wild exploitation yet, and a sandbox escape chain would be required for full system compromise, which this CVE alone does not provide. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing specially crafted media content that triggers a use-after-free in Chrome's Media component when the victim visits it. The dangling pointer is reclaimed with attacker-controlled data to achieve arbitrary code execution within the renderer sandbox. No public exploit code has been identified, and successful exploitation requires the victim to actually load the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
RemediationAI
The primary fix is to upgrade Google Chrome to version 155.0.8059.79 or later, which is the vendor-released patch delivered through the Stable Channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html and tracked in Chromium issue 570638834 (https://issues.chromium.org/issues/570638834); after updating, users must fully restart the browser for the new version to take effect, and version can be confirmed at chrome://version. For fleets, enforce the update through enterprise policies such as Chrome Browser Cloud Management or managed auto-update, and treat the Chromium issue and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-110151) as the reference records. Where immediate updating is not possible, compensating controls must be applied with their trade-offs understood: because the vulnerability is reached through media content in a crafted HTML page, restricting users from visiting untrusted sites (via DNS/proxy allowlisting or blocking uncategorized domains) reduces exposure but degrades general browsing and will not stop attacks hosted on otherwise legitimate or compromised sites; keeping the renderer sandbox and site isolation enabled (they are on by default - do not disable them for compatibility troubleshooting) ensures that any successful trigger remains contained in the renderer, but this is containment rather than prevention and still leaves a sandbox-escape chain as the residual host-level risk; disallowing the installation of untrusted extensions and enforcing Safe Browsing/Enhanced Protection adds detection value but is not a deterministic block. Google's advisory and the referenced Chromium issue are the authoritative sources for any further mitigation guidance specific to this Media component fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-416, use-after-free, occurring in Chrome's Media component - the browser layer that handles HTML5 audio/video playback, media element lifecycle, demuxing and codec interaction. A memory object used during media parsing or playback can be freed while a reference to it is still held, so an attacker-controlled media payload delivered through a crafted HTML page can cause the code to operate on reclaimed memory, potentially gaining control of execution inside the renderer process. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector indicates network reachability, low attack complexity, no authentication requirement, mandatory user interaction, and high confidentiality, integrity and availability impact, but with scope unchanged - meaning the compromise is bounded by the renderer sandbox, and full host takeover requires a second, independent sandbox-escape exploit. The reported severity is Critical in Chromium's own grading, and the technical impact is assessed by CISA's SSVC framework as total, though exploitation has not been observed and the flaw is not assessed as automatable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N/AC:L/PR:N) requires the victim to open the page (UI:R); code runs within the sandbox so scope is unchanged (S:U) with high renderer-context C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.79 are affected by a high-severity remote code execution vulnerability in the Media component. Although no public exploit code has been identified at time of analysis, the flaw is unauthenticated and requires user interaction, meaning an attacker could compromise a user's browser session by tricking them into visiting a malicious webpage. Given Chrome's widespread deployment, leadership should prioritize patching to prevent potential data breaches or lateral movement within the network.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB