EUVD-2026-102519
GHSA-m56x-vh7j-xrcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Workers
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user interaction (UI:R): the victim must navigate to an attacker-controlled or compromised page serving crafted HTML that reaches Chrome's Workers component. No authentication or privileges are needed (PR:N). Critically, successful exploitation grants code execution only INSIDE the renderer sandbox (Scope:Unchanged) - it does not by itself escape to the host OS, so full system compromise requires chaining a separate sandbox-escape vulnerability. Limiting factors: the required user action of visiting the page, confinement to the sandbox, and the fact that users on Chrome 155.0.8059.84 or later are not affected. |
| Impact | Signals conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) rates this High, yet Chromium's own project severity is labeled Medium and the SSVC decision framework reports Exploitation: none and Automatable: no (with Technical Impact: total). KEV status is NO and no POC is indicated in the input, so exploitation status is 'no public exploit identified at time of analysis'. EPSS is not provided, so widespread-exploitation probability cannot be quantified. A key nuance the raw 8.8 obscures: the description explicitly states code execution occurs 'inside the sandbox' with Scope:Unchanged - i.e. this is sandboxed RCE, not full host compromise, and a separate sandbox-escape bug would be required for real-world system takeover. This largely explains the Medium Chromium rating despite C/I/A all High. Net: a patch-worthy memory-corruption flaw in a ubiquitous browser, but with no evidence of active or automatable exploitation and impact confined to the renderer sandbox, this is a routine-priority browser-update item rather than an emergency, absent a chained escape. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption condition in Chrome's Workers component when a victim navigates to it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (not the host OS). No public exploit code is identified in the provided data, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Memory corruption in Google Chrome's Workers component affects versions prior to 155.0.8059.84 and can allow a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim visits a crafted HTML page. The CVSS vector indicates network reachability, no authentication, and required user interaction, with high confidentiality, integrity, and availability impact inside the sandbox; however, Scope is Unchanged, so full host compromise requires a separate sandbox escape. Assessment signals conflict and should be weighed carefully: CVSS is 8.8 while Chromium rated it Medium, SSVC says exploitation is none and automatable is no, and no public exploit identified at time of analysis; a vendor patch is available.
RemediationAI
Upgrade Google Chrome to 155.0.8059.84 or later; this is the vendor-released patch for CVE-2026-110914, available via the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html. Verify update through Chrome's built-in update mechanism or enterprise management and restart the browser to apply it. If immediate patching is impossible, reduce exposure to untrusted HTML through web filtering and, where operationally feasible, disabling JavaScript, but note that disabling JavaScript will break many sites and is not a complete fix. The renderer sandbox confines successful exploitation and should be treated as containment, not a substitute for patching; full host compromise would require additionally chaining a sandbox-escape vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is in Google Chrome's Workers implementation, a Chromium component that runs JavaScript in background threads for web applications. The root cause is a memory-safety flaw classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), also described as buffer overflow in the provided tags, which can be triggered by a crafted HTML page. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* marks Chrome as the affected product, and the fixed release is 155.0.8059.84 per the Chrome stable-channel advisory; EUVD lists the affected Chrome version as prior to that fix. Because the CVSS vector has PR:N/UI:R and Scope:Unchanged, exploitation is unauthenticated remote but requires user interaction and is expected to yield code execution within the renderer sandbox rather than across a privilege boundary.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but requiring the victim to visit (UI:R); sandboxed memory-corruption RCE gives high C/I/A within the renderer, and Scope stays Unchanged as no escape is claimed.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.84 contain a memory corruption flaw in the Workers component that could allow a remote, unauthenticated attacker to execute code inside the browser's renderer sandbox if a user visits a crafted HTML page. Because Chrome is widely deployed, unpatched endpoints could expose browser session data and integrity to malicious web content, though full host compromise would require a separate sandbox escape. Vendor-released patch: 155.0.8059.84 is available, and no public exploit identified at time of analysis, so leadership should prioritize rapid update enforcement while monitoring for unusual browser behavior.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB