EUVD-2026-105649
GHSA-chfp-w7q9-qfrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious CSS in HTML
-
ExecutionTrigger CSS memory corruption
-
ImpactExecute code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML/CSS in Google Chrome versions prior to 156.0.8078.47 (UI:R - the user must open the crafted page, e.g. via a link, malvertising, or compromised site). No authentication or special privileges are needed (PR:N). The key LIMITING factor is that code execution is confined to the Chrome renderer sandbox: the flaw alone does not compromise the host OS and must be chained with a separate sandbox-escape to achieve full system RCE. Patched builds (156.0.8078.47 and later) are not affected. |
| Impact | This is a credible high-priority browser flaw, but with an important ceiling. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated bug that only requires a victim to open a crafted HTML page - a realistic condition for drive-by attacks. However, two signals temper the raw 8.8 score: (1) the description explicitly states code execution occurs 'inside the sandbox,' meaning a successful exploit alone does NOT yield full host compromise - it must be chained with a separate sandbox-escape to be fully weaponized, which the C:H/I:H/A:H + S:U vector does not reflect; and (2) Chromium rated this issue only 'Medium' severity, which conflicts with the 8.8 CVSS and suggests the practical impact is more constrained than the number implies. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation. Net: patch promptly because of Chrome's ubiquity and the low-interaction attack surface, but treat it as a sandbox-confined memory-corruption bug (sandbox escape required for RCE on the host), not a confirmed one-click full takeover. Note the CVSS/Chromium-severity disagreement and the missing EPSS/KEV data explicitly when prioritizing. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects crafted content into a compromised/advertising frame) containing CSS that triggers the memory-corruption condition. A victim simply visits the page (UI:R), and the attacker achieves arbitrary code execution within the Chrome renderer sandbox. No public exploit code was identified in the provided data, and full host compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Chrome's CSS handling lets a remote attacker who convinces a victim to load a crafted HTML page trigger arbitrary code execution inside the renderer sandbox, affecting Chrome builds prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) means exploitation is unauthenticated but requires user interaction - the target must open the malicious page via a link, malvertising, or a compromised site. Impact is capped by the sandbox: full host compromise requires chaining with a separate sandbox-escape, and no public exploit or CISA KEV entry was identified at time of analysis, though Google rates the flaw Medium on its own severity scale.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; enterprise fleets should push the update through their normal Chrome management pipeline and verify the reported version. Until patched builds are universally deployed, reduce exposure by keeping users on the current release, enforcing automatic browser updates, and treating unsolicited links and malvertising-driven landing pages as the primary delivery vector - the UI:R prerequisite means user behavior is a meaningful control surface. Because the bug is confined to the renderer sandbox, hardening measures such as Chrome's site isolation (already on by default) and, where policy permits, stricter sandboxing or JavaScript/CSS-heavy content filtering limit blast radius, at the cost of compatibility with some web applications. There is no server-side workaround; the only complete fix is the 156.0.8078.47 update or a derivative vendor's equivalent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer, arising in Chrome's CSS parsing/rendering code path. CSS is processed in the renderer process by Blink's style engine, so a malformed style declaration or stylesheet can drive out-of-bounds reads/writes in that component. Because the renderer is sandboxed, successful corruption yields code execution with renderer privileges only - an attacker needs a second, independent sandbox-escape bug to reach the OS. The bug was reported through Google's Chromium issue tracker (issues.chromium.org/560664595) and fixed in the 156.0.8078.47 stable channel update; ENISA EUVD tracks it as EUVD-2026-105649, and CPE/version data confirms only builds below 156.0.8078.47 are exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted HTML page requires victim interaction (UI:R) but no auth (PR:N) over the network; code runs in-sandbox with high C/I/A impact and no scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 carry a high-severity memory-corruption flaw that could allow an attacker to execute code within the browser renderer when a user opens a crafted webpage. Because Chrome is widely deployed across the workforce, unpatched endpoints create broad exposure that could affect productivity and increase data-loss risk, although the renderer sandbox limits full host compromise. Leadership should prioritize rapid browser patching and verify update compliance across managed and unmanaged devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB