EUVD-2026-100647
GHSA-g9qr-6g59-6hfv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious HTML/JS to V8
-
ExecutionTrigger use-after-free in V8 engine
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 155.0.8059.79 and to load attacker-controlled content - the crafted HTML page - in the browser (CVSS UI:R confirms required user interaction, e.g., visiting a page). No authentication or special non-default configuration is needed (PR:N; the flaw is in the core V8 JavaScript engine enabled by default). The primary limiting factors are: (1) a user must be induced to visit malicious content, and (2) per the description, code execution is confined to within the sandbox, so full host compromise would additionally require a separate sandbox-escape vulnerability not covered by this CVE. |
| Impact | Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated memory-corruption flaw that only requires a victim to visit a crafted page. However, CISA's SSVC decision framework reports Exploitation: none, Automatable: no, and Technical Impact: total, which tempers the urgency: there is no evidence of active exploitation and the attack is not readily automatable (it depends on luring users to malicious content). No EPSS score was supplied in the input, and the CVE is NOT listed in CISA KEV; no public POC is referenced. A key mitigating nuance the raw 8.8 obscures is that the description scopes code execution to 'inside the sandbox' - i.e., the V8/renderer sandbox - not the host OS, so without a chained sandbox escape the practical impact is more contained than the C:H/I:H/A:H vector implies. Net assessment: a legitimate High-severity browser RCE warranting prompt patching, but currently theoretical rather than actively weaponized; its real-world danger rises sharply only if combined with a sandbox-escape chain or if exploitation activity later emerges. |
| Exploit ScenarioDerived | An attacker hosts a malicious or compromised web page containing crafted JavaScript/HTML that triggers the use-after-free in Chrome's V8 engine when rendered. A user running a Chrome version prior to 155.0.8059.79 visits the page (via phishing link, malvertising, or a watering-hole site), and the attacker achieves arbitrary code execution within the renderer/V8 sandbox. No public exploit code is identified at time of analysis, so a working exploit would need to be developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.79. Upgrade to 155.0.8059.79 or later via Chrome's built-in updater (chrome://settings/help) or your enterprise software-distribution channel, and confirm the reported version before considering the asset remediated; the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html and the NVD/EUVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-110169 should be referenced for tracking, and the upstream bug at https://issues.chromium.org/issues/567088929 can be consulted for merge status in Chromium derivatives. There is no supported configuration toggle that disables V8, so no clean feature-level workaround exists; practical compensating controls until patching completes are to keep users on a restricted allowlist of trusted sites via enterprise URL policies, block or sandbox untrusted content through secure web gateways and download inspection, and enforce site isolation and OS-level exploit mitigations, accepting the trade-off that these measures reduce attack surface and reliability of exploitation but do not eliminate the bug and may break legitimate workflows against unlisted sites. Because the CVE's impact is bounded by the browser sandbox, layered endpoint detection and prompt browser restarts after update should be prioritized over emergency out-of-band action, consistent with the assessment that this is a serious but not emergency-level priority.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in V8, Chrome's JavaScript and WebAssembly engine, which compiles JavaScript to native code via TurboFan/Maglev and reclaims memory with its own garbage collector. In this class of bug, an object is freed while a dangling reference to it remains reachable; if the attacker can force the freed memory region to be reallocated with data they control, the stale pointer resolves to attacker-shaped memory, typically producing type confusion, an out-of-bounds read/write primitive, or direct control-flow hijack inside the renderer process. Because the vulnerable component is the core JavaScript engine, it is reachable from ordinary web content with no extension, plugin, or elevated privilege, which is why the vector is PR:N. Chromium's multi-process sandbox and Mojo IPC validation are what keep this primitive from being an immediate full-host compromise; the CVSS scope remains Unchanged (S:U), reflecting that the demonstrated impact is confined to the browser process boundary rather than escalating across security scopes. CPE data was not supplied in the input, and the affected product is identified through the Chrome stable-channel release and the EUVD record referencing builds below 155.0.8059.79.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page trigger (AV:N) requiring only a page visit (AC:L, UI:R) with no auth (PR:N); code execution within the unchanged renderer sandbox scope (S:U) yields high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.79 contain a high-severity use-after-free vulnerability in the V8 JavaScript engine that enables in-sandbox remote code execution when a user visits a malicious webpage. This puts all organizational users of Chrome at risk, as exploitation could lead to unauthorized data access or further compromise if chained with a sandbox escape, though no public exploit identified at time of analysis. A vendor patch is available, and leadership should prioritize its deployment to protect critical business operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB