EUVD-2026-102518
GHSA-78vg-4v35-6w97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Compositing
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Chrome prior to 155.0.8059.84 (UI:R - user interaction via visiting a crafted HTML page); no authentication or special privileges are needed and default browser configurations are affected. The principal LIMITING factor is sandbox containment: per the description, resulting code execution occurs 'inside the sandbox,' so full host compromise requires chaining a separate sandbox-escape vulnerability. No special browser feature, flag, or non-default setting is stated as a prerequisite beyond running an unpatched version. |
| Impact | This is a genuinely high-priority flaw by severity but with important real-world caveats. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a remote, low-complexity, unauthenticated bug requiring only that a victim open a crafted HTML page - the classic drive-by browser profile. CWE-416 (use-after-free) in the Compositing component is a memory-corruption class historically very exploitable in Chrome. However, three signals temper the urgency and partially conflict with the raw score: (1) the description explicitly scopes code execution to 'inside the sandbox,' meaning this alone does not achieve host compromise without a separate sandbox-escape chain, yet CVSS still rates C:H/I:H/A:H and S:U (no scope change); (2) CISA SSVC reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no identified public POC, so there is no evidence of active or automated exploitation at this time; (3) Chromium itself rated this 'Medium' severity, which is lower than the NVD-style 8.8 CVSS 'High' - a common and expected divergence because Google weights the sandbox containment while CVSS does not. Net: patch promptly given ubiquity and the UAF class, but current exploitation likelihood is low and real-world impact is bounded by the sandbox absent a chained escape. EPSS was not provided in the input and cannot be factored in. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing specially crafted content that triggers the use-after-free in Chrome's Compositing code when a victim simply visits it (UI:R). Successful exploitation yields arbitrary code execution confined to the renderer sandbox; a real-world intrusion would typically pair this with a separate sandbox-escape bug to reach the host. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
RemediationAI
Google has shipped a vendor patch in Chrome 155.0.8059.84; upgrade to that build or later via chrome://settings/help, your OS package manager, or managed enterprise update channels, and fully restart the browser (and any Chromium-based derivatives) so the new binary is loaded. Details are in the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html and the Chromium bug at https://issues.chromium.org/issues/556272421. Until every endpoint is patched, keep the browser sandbox and site isolation enabled rather than disabling them for compatibility, since the sandbox is the control that keeps this flaw from becoming host-level RCE; a short-term workaround for high-risk users is restricting browsing to trusted sites or running Chrome in a disposable VM until the rollout completes. Disabling JavaScript or the compositor entirely is not a practical mitigation and would break most sites, so patch latency should be minimized instead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in Chrome's compositing subsystem, the component that assembles painted layers and hands them to the GPU/Viz process for display. When an object is freed but a stale reference is later dereferenced, an attacker who controls the triggering content can shape heap contents to hijack control flow, producing the memory-corruption condition tagged as RCE and denial of service. CPE coverage (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) indicates the flaw spans Chrome releases across platforms, with all builds before 155.0.8059.84 affected. Notably, the 8.8 CVSS score sits well above Google's own 'Medium' Chromium severity rating, a mismatch worth flagging when triaging: the vector reflects worst-case memory-corruption impact, while Google's rating likely accounts for the sandbox containment described in the advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N, AC:L, PR:N) needing a victim visit (UI:R); UAF enables renderer-process code execution (C/I/A:H) but stays in-sandbox, so S:U.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.84 carry a high-severity remote code execution risk that can be triggered during ordinary web browsing, putting any employee who uses an unpatched browser at risk. While no public exploit has been identified and the impact remains contained within Chrome's sandbox, the broad enterprise use of Chrome and the low attacker barrier make prompt patching a management priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB