EUVD-2026-100633
GHSA-55gq-mc37-r4pg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
ExploitLure victim to visit page
-
ExecutionTrigger use-after-free in Bindings
-
ImpactRead sandboxed renderer memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively load attacker-controlled content: the attacker must get the user to visit a crafted HTML page in a vulnerable Chrome build (any version prior to 155.0.8059.79), so there is no server-side or default-exposure path. Exploitation is limited by the mandatory user interaction (UI:R), the fact that impact is confined to reading memory inside the renderer sandbox (no sandbox escape, no code execution, no data modification per C:L/I:N/A:N), and Chrome's rapid automatic update mechanism, which narrows the exposure window. No special non-default configuration is required, and no authentication is needed (PR:N). |
| Impact | This is a genuinely low-priority issue despite the 'High' Chromium severity label, which reflects internal triage urgency rather than real-world exploitation risk. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates network-reachable, unauthenticated exploitation but requires user interaction (visiting a crafted page) and yields only limited confidentiality impact (C:L) with no integrity or availability impact - consistent with the description's 'read memory inside the sandbox.' All exploitation signals align toward low risk: EPSS is 0.17% (6th percentile), the CVE is not listed in CISA KEV, no public exploit code is identified, and CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. The signals are mutually consistent with no major conflicts. One notable discrepancy: the 'Denial Of Service' tag conflicts with the CVSS vector's A:N (no availability impact) and the description, which describes a sandboxed memory-read (information disclosure), not a crash or DoS - the tag appears mislabeled. Net: a real but low-urgency bug best handled by routine Chrome auto-update rather than emergency patching. |
| Exploit ScenarioDerived | A remote attacker lures a victim into visiting a malicious or compromised web page that triggers a use-after-free in Chrome's Bindings component. Because exploitation requires the victim to load the crafted HTML (UI:R), the attacker relies on phishing or malvertising; successful triggering lets the attacker read a limited amount of memory from within the renderer sandbox, with no public exploit code currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A use-after-free in Chrome's Bindings component allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) and is confined to the sandboxed renderer process - the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) reflects limited confidentiality impact only, with no integrity or availability effect and no sandbox escape, code execution, or privilege gain. Despite Google's 'High' Chromium severity label, there is no public exploit identified at time of analysis, EPSS is only 0.17% (6th percentile), and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable, making this a low real-world priority that is mitigated by Chrome's rapid automatic update mechanism. A vendor patch is available (Chrome 155.0.8059.79).
RemediationAI
Upgrade to Google Chrome 155.0.8059.79 or later - Vendor-released patch: 155.0.8059.79, per the Chrome stable-channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html); users on the extended stable channel need the corresponding extended-stable update (https://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html). Because the issue is remotely reachable only through a crafted HTML page, ensure automatic updates are enabled and verify the version via chrome://version rather than relying on the update prompt, then restart the browser so pending binaries are actually applied - a restart step admins frequently skip and which leaves the vulnerable renderer in memory. There is no meaningful server-side workaround, and generic mitigations carry real trade-offs: disabling JavaScript or blocking untrusted sites via policy (e.g., URLBlocklist or JavaScript blocklists) fully removes the attack surface but breaks most modern web applications; running Chrome in a lower-privilege account, AppContainer, or VM reduces the value of any leaked renderer memory but degrades performance and usability; and prompt patching is by far the cheapest control given the low EPSS (0.17%) and the absence of KEV listing, public exploit code, or automatable exploitation per CISA SSVC. No additional compensating control is warranted for most environments; prioritize the update for high-value users who routinely browse untrusted content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) in Chrome's Bindings layer - the interop glue that exposes browser-engine objects to the JavaScript/Blink execution environment. A dangling reference left reachable by script logic through a crafted HTML page lets attacker-controlled script reference freed memory, resulting in an out-of-bounds read rather than write. Because the flaw sits in the renderer's own process and is paired with the standard Chrome sandbox, the maximum achievable effect is disclosure of memory within that sandboxed renderer; the assessed vector's C:L with I:N/A:N confirms read-only exposure and no path to host compromise in this assessment. Chrome's Browser/Bindings separation and the site-isolation model mean any leaked bytes are constrained to data already resident in the compromised renderer, which is why the impact is rated partial/low despite the memory-corruption tag. CPE and EUVD data identify the affected product simply as Chrome at versions below 155.0.8059.79, covering both the stable channel and the extended stable channel updates referenced in the Google Chrome Releases advisories.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Crafted web page is network-reachable and unauthenticated (AV:N/PR:N) but needs the victim to load it (UI:R); impact is a limited sandboxed memory read, so C:L with I:N/A:N.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB