EUVD-2026-105761
GHSA-xp8q-63p6-3vjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Loader
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to actively navigate to (or be redirected to) attacker-controlled HTML content - the CVSS UI:R metric confirms this user-interaction requirement is mandatory. The primary limiting factor is that successful exploitation yields code execution only 'inside the sandbox' (scope Unchanged), so full host compromise additionally requires chaining a separate sandbox-escape vulnerability. No special non-default Chrome configuration is indicated; the flaw affects standard rendering via the Loader component. |
| Impact | CVSS 3.1 scores this 8.8 (High) with a fully remote, low-complexity, unauthenticated profile (AV:N/AC:L/PR:N) requiring only user interaction (UI:R) - i.e. a victim visiting a crafted HTML page. However, two signals pull hard against treating this as a top-tier priority. First, Google/Chromium rated the security severity 'Low', and the description explicitly states code executes 'inside the sandbox' with CVSS scope Unchanged (S:U) - meaning this flaw alone does not escape Chrome's renderer sandbox and must be chained with a separate sandbox-escape bug to achieve host compromise. This contrast (CVSS 8.8 High vs vendor 'Low') is the single most important nuance here: the 8.8 reflects renderer-process C/I/A impact, not full-system takeover. Second, no EPSS score, no KEV listing, and no POC were provided in the input, so there is no evidence of active or imminent exploitation. Net assessment: this is a patch-on-normal-cadence browser memory-corruption bug, not an emergency - real-world risk is moderated by sandbox containment and the absence of any exploitation signal, despite the headline 8.8. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption flaw in Chrome's Loader component; a user running a pre-156.0.8078.47 build visits the page and the attacker gains arbitrary code execution within the constrained renderer sandbox. To reach the host OS the attacker would then need to chain a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Loader component before 156.0.8078.47 allows remote attackers to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The issue carries a High CVSS score of 8.8 because exploitation is network-reachable and unauthenticated with only user interaction required, although Chromium's own severity rating is Low and the resulting code execution remains confined to the sandbox, so full host compromise would require a separate sandbox-escape chain. The vendor has released a fixed build, and no public exploit code or active exploitation is identified in the provided intelligence.
RemediationAI
Update Google Chrome to version 156.0.8078.47 or later using the vendor's stable-channel release, then fully restart the browser, including all background processes, and verify the installed version via chrome://version. The Chrome release advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and Chromium issue 563015686 should be tracked for any vendor follow-up. Because exploitation requires the victim to load crafted HTML, organizations that cannot immediately deploy the update can reduce exposure by restricting untrusted web content through enterprise URL filtering, remote browser isolation, or disposable virtual machines for high-risk browsing, accepting that these controls limit functionality and do not eliminate the underlying memory-corruption flaw. Browser auto-update policies and forced relaunch settings can help ensure the fixed build is applied across managed endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, in Chrome's Loader component. This is a memory-corruption bug in the page-loading/resource-handling path that is reachable through crafted HTML content; the exact component boundary and technical details are tracked in the referenced Chromium issue. Because the corruption occurs in a browser component that processes web content, an attacker can potentially turn the memory-safety failure into arbitrary code execution within the renderer sandbox. The CVSS vector confirms the attack is remote (AV:N), low complexity (AC:L), unauthenticated (PR:N), and requires the victim to interact with the crafted page (UI:R); scope is Unchanged, consistent with sandbox-contained code execution rather than direct host compromise. No CPE strings were supplied, but EUVD identifies Chrome builds around the 156.0.8078.47 release boundary as affected, with the fixed version being 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim navigation (AV:N, UI:R) but no auth (PR:N); code runs within the renderer sandbox so scope is Unchanged (S:U) with high renderer-process C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome's Loader component has a memory-corruption flaw, fixed in version 156.0.8078.47, that could allow code execution inside the browser sandbox when a user opens a crafted page. Because Chrome is broadly deployed across the workforce, unpatched endpoints create widespread exposure even though no public exploit was identified at time of analysis. Leadership should prioritize rapid browser fleet remediation to reduce risk while recognizing that the impact remains sandbox-confined and would require a separate escape chain for full host compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB