EUVD-2026-100660
GHSA-phj8-c2q3-q844
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious media content in renderer
-
ExploitTrigger use-after-free in Media component
-
ExecutionReclaim freed memory and hijack control flow
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or navigate to an attacker-controlled crafted HTML page containing malicious media content (CVSS UI:R) while running Google Chrome prior to 155.0.8059.79; no authentication or special configuration is needed and default installations are affected. Key limiting factors: user interaction (page visit) is mandatory, and because arbitrary code executes only inside the renderer sandbox (scope unchanged, S:U), an attacker needs a separate sandbox-escape vulnerability to achieve full host compromise - substantially raising the bar for real-world impact despite the network attack vector. |
| Impact | Signals are mixed and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug requiring only that a victim load a page - the classic high-severity browser profile. However, CISA's SSVC decision framework reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is currently no evidence of real-world exploitation. EPSS is not provided in the input and cannot be factored in. A critical nuance the raw 8.8 obscures: the description states code executes INSIDE the sandbox (scope S:U confirms no scope change), so this is a renderer-level RCE that still requires a separate sandbox-escape chain to fully compromise the host - reducing standalone real-world impact. Net: a genuinely serious bug worth patching promptly given Chrome's reach, but not an emergency relative to its headline score, since exploitation is non-trivial (UI required, chaining needed) and no active exploitation or POC is known. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious media content and lures a victim running an unpatched Chrome (prior to 155.0.8059.79) to visit it. The crafted HTML triggers a use-after-free in Chrome's Media component, letting the attacker corrupt memory and execute arbitrary code within the renderer sandbox. No public exploit code has been identified at time of analysis, and full host compromise would require an additional sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.79 (stable channel), detailed in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html; organizations tracking the extended stable channel should apply the build described at http://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html. Update via the browser's built-in updater or your enterprise software-distribution/patch-management tooling, then fully restart Chrome so the new binary is loaded, and verify the applied version at chrome://version; because the vulnerable component is loaded at process start, an update without a browser restart leaves the old renderer code in memory. Until the update is deployed, the most effective compensating control is preserving the renderer sandbox intact - the exploit yields code execution only inside the sandboxed renderer, so keeping OS-level sandboxing enabled and avoiding privileged or unsandboxed launch flags materially raises the bar for a full compromise. Administrators can additionally reduce exposure to the affected media-parsing code paths by disabling hardware-accelerated video decoding/GPU acceleration via chrome://settings or the HardwareAccelerationModeEnabled/Hardware acceleration enterprise policies, accepting degraded video playback performance and higher CPU usage during media playback as the trade-off. Restricting browsing to trusted sites (for example, blocking untrusted categories through enterprise URL policies or filtering) and isolating high-value web activity to a separate, low-privilege browser profile limits the likelihood of a victim reaching attacker-controlled media content. Given that no public exploit code has been identified and SSVC records exploitation as "none," these interim controls should be treated as temporary measures pending the 155.0.8059.79 upgrade, which remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in Chrome's Media component, the Chromium code path that handles audio/video demuxing, decoding, and playback for HTML media elements (and the associated Media Source Extensions / media pipeline machinery). A use-after-free occurs when the browser releases a heap object in the media pipeline but retains a dangling reference to it; when parsing attacker-supplied media data causes that stale pointer to be reused, the attacker can influence the contents of freed memory and redirect control flow, yielding arbitrary code execution with the privileges of the renderer process. Because the flaw is reached through a crafted HTML page rather than a direct memory-corruption primitive over the network, it is delivered as a drive-by browser attack requiring the victim to load the page (UI:R), which is reflected in the CVSS vector's network vector combined with required user interaction and no privilege requirement (PR:N). Google classifies the issue as High severity and credits internal Chromium security administration for the report; the affected code ships in Google Chrome for Desktop (Windows, macOS, Linux) and, by inheritance, in Chromium-based derivatives built from the same source snapshot. Note that the supplied CPE/version data is limited and lists the affected range as builds preceding 155.0.8059.79; the sandbox boundary means the exploit's technical impact is total within the renderer process but does not by itself grant host-level compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N, but victim must load the page (UI:R); code runs within the renderer sandbox so scope is unchanged (S:U) with full C/I/A impact in that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 155.0.8059.79 contain a use-after-free flaw in the media component that can allow a remote, unauthenticated attacker to execute code inside the browser's renderer sandbox when a user opens a malicious HTML page. Default desktop installations are exposed because no credentials or non-default settings are required, so unpatched workforce browsers represent a broad organizational risk. With no public exploit identified and a vendor patch available, leadership should prioritize rapid update enforcement while recognizing that full system compromise would require a separate sandbox escape.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB