EUVD-2026-105489
GHSA-rpfp-p9cx-884r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger IME memory corruption in renderer
-
ExecutionExecute arbitrary code within sandbox
-
ImpactStage for sandbox escape / data access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim using Google Chrome prior to 156.0.8078.47 be induced to load attacker-controlled HTML content that exercises the IME (Input Method Editor) code path (CVSS UI:R confirms required user interaction). No authentication or special privilege is needed (PR:N), and default configurations are affected since IME handling is standard browser functionality. The key limiting factor is sandbox containment: the description states code executes 'inside the sandbox' (S:U), so a separate sandbox-escape vulnerability would be required to impact the underlying host; realistic full-system compromise therefore depends on chaining this with another flaw. |
| Impact | Signals are mixed and point to moderate-but-real priority rather than emergency. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a victim load a crafted HTML page - standard for browser drive-by bugs. However, the description explicitly limits code execution to 'inside the sandbox,' and Chromium's own triage rates this Medium severity, both of which temper the 8.8 figure: without a chained sandbox-escape, an attacker is confined to the renderer process and cannot by itself reach the host OS. No EPSS score, KEV listing, or public POC is provided in the input, so there is no evidence of active exploitation or weaponization at this time. Note the tension to verify: the external CVSS is High (8.8) while the vendor's intrinsic rating is Medium and scope is Unchanged (S:U) - the sandbox containment is the likely reason, and defenders should treat C:H/I:H/A:H as applying within the renderer process, not the full system. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing markup/input-method content that triggers the IME memory-corruption bug. A user running an unpatched Chrome (before 156.0.8078.47) visits the page, and the corruption is leveraged to execute attacker-controlled code within the renderer sandbox. No public exploit code is identified in the provided data, and the attack requires user interaction (visiting the page). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Input Method Editor (IME) component of Google Chrome allows a remote attacker to potentially achieve code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires user interaction (CVSS UI:R) with no authentication or privileges needed (PR:N). Impact is bounded by sandbox containment - the assessed vector is S:U, so full host compromise would require chaining with a separate sandbox-escape flaw; no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis, though a vendor fix is available.
RemediationAI
Upgrade to Google Chrome 156.0.8078.47 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html (Vendor-released patch: 156.0.8078.47); enterprise fleets should push this build through their update mechanism and verify version compliance rather than relying on auto-update alone. Where immediate rollout is impossible, reduce exposure by disabling or restricting unnecessary IME input methods and third-party IME extensions through Chrome enterprise policy - accepting the trade-off that multilingual users lose text composition until patched - and treat high-risk browsing (unsolicited links, embedded frames from untrusted origins) as the primary delivery vector given the required user interaction. Because in-sandbox code execution is the worst case for this CVE alone, keep site isolation and the renderer sandbox enabled and prioritize a current build so that any chained sandbox-escape flaw is also remediated; note that these controls mitigate but do not remove the underlying memory-corruption risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic memory-corruption defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in Chrome's IME handling layer - the subsystem that brokers text composition from platform input methods and third-party IME extensions into the renderer. Crafted HTML that drives the IME code path can produce out-of-bounds memory operations, which in Chromium's C++ renderer typically escalates from heap corruption to controlled instruction flow. Because the impact is contained within the renderer sandbox per the assessed scope (S:U), the immediate consequence is arbitrary code execution at renderer privilege rather than host takeover; escaping the sandbox would require a second, independent vulnerability. The underlying component is Chromium's open-source content/IME stack shared across Chrome channels and downstream Chromium-derived browsers.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must load it (UI:R); renderer-process code execution yields C/I/A:H with scope unchanged due to sandbox containment.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a memory-corruption flaw in the Input Method Editor that can allow a remote attacker to execute code inside the browser sandbox when a user simply loads a crafted HTML page. Because Chrome is widely deployed across the organization and exploitation requires only user interaction, unpatched endpoints represent a broad, low-friction exposure; however, the sandbox limits the immediate blast radius, and full host compromise would require chaining a separate sandbox-escape vulnerability. Leadership should care because this is a browser-ubiquity issue affecting the general workforce, but no public exploit or active exploitation has been identified at time of analysis and a vendor fix is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB