EUVD-2026-100651
GHSA-frwj-w92g-qhq5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in DOM
-
ExecutionReclaim freed object memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in Chrome prior to 155.0.8059.79 (UI:R) - there is no server-side or default-listener exposure. No special non-default Chrome configuration is named in the description; any standard browsing session rendering the crafted page is sufficient to reach the vulnerable DOM code. Key limiting factors: (1) user interaction is mandatory (the user must navigate to the malicious page), and (2) resulting code execution is confined to the renderer sandbox per the description, so full host compromise additionally requires a separate sandbox-escape vulnerability not covered by this CVE. |
| Impact | Signals are moderately conflicting and point to a credible-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, 8.8 High) indicates a network-reachable, low-complexity, unauthenticated memory-corruption flaw that nonetheless requires user interaction - the victim must open a crafted HTML page. CISA's SSVC decision framework reports Exploitation: none and Automatable: no, which aligns with the absence of any KEV listing and no public exploit evidence in the provided data, while rating Technical Impact: total (consistent with arbitrary code execution). Critically, the description states code execution occurs INSIDE the Chrome sandbox, so absent a chained sandbox-escape this is not full host compromise - the raw 8.8 somewhat overstates real-world impact on its own. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. Net: a genuine high-severity browser bug worth prompt patching given Chrome's ubiquity, but currently no evidence of active or automatable exploitation, and the UI:R requirement plus sandbox confinement meaningfully limit practical risk versus a wormable RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's DOM engine; a user is lured to visit it (e.g., via phishing or malvertising) and the flaw is exploited to run attacker-controlled code within the renderer sandbox. No public exploit code was identified in the provided data, and execution is confined to the sandbox absent a separate escape. The low attack complexity (AC:L) makes reliable triggering plausible, but the required user interaction (UI:R) gates the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.79 (and the corresponding extended stable channel update). Administrators and users should update to the latest stable or extended stable release immediately via the browser's built-in updater or by downloading it from Google. See the stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html) and the extended stable advisory (https://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html). No specific workarounds are documented for this DOM use-after-free, but because the vulnerability is reachable only through a crafted HTML page, reducing exposure to untrusted web content (e.g., restricted browsing policies, script blockers, or enterprise URL filtering) can limit attack opportunities, though these measures have operational costs and do not replace patching. The renderer sandbox provides defense-in-depth by confining any resulting code execution; keep site isolation and other sandbox protections enabled, and ensure an additional sandbox-escape vulnerability is not present to prevent host compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in Chrome's DOM implementation, a memory-safety flaw where the browser continues to reference a memory object after it has been freed. A crafted HTML page can manipulate DOM objects to trigger the dangling pointer, leading to memory corruption that may be leveraged for arbitrary code execution. The vulnerable component resides in the renderer process; per the description, any code execution achieved is confined to the sandbox. The affected code is present in Google Chrome versions before 155.0.8059.79, and the issue is tracked in Chromium issue 568730794. The CWE-416 class is a common source of browser exploits because it can be triggered by untrusted web content without authentication, though user interaction to load the page is required (UI:R).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but mandatory user navigation (UI:R); sandboxed renderer code execution keeps scope unchanged (S:U) with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome releases prior to 155.0.8059.79 contain a use-after-free flaw in the DOM component that can be triggered when a user simply visits a crafted web page, potentially allowing an attacker to run code inside the browser's renderer sandbox. Because Chrome is deployed broadly across the organization and browsing untrusted sites is routine business activity, nearly every workstation and remote worker is exposed, and the flaw carries high confidentiality, integrity, and availability impact within the browser session. Full compromise of the underlying machine would require a separate sandbox escape, so the immediate risk is concentrated in browser-level data and sessions, but the vendor patch is already available and should be prioritized for rapid deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB