EUVD-2026-105717
GHSA-q2wf-7p78-5v25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in WebAppInstalls
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to navigate to attacker-controlled crafted HTML in a vulnerable Chrome build (before 156.0.8078.47), and the use-after-free is reached through the WebAppInstalls feature path - so user interaction (opening the page) is a mandatory limiting factor (UI:R). No authentication or prior privileges are needed (PR:N). The decisive limiting condition is sandbox containment: the description states code execution occurs inside the sandbox, so standalone impact is confined to the renderer process and full system compromise would additionally require a separate sandbox-escape primitive. |
| Impact | Signals conflict sharply and must be read together. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H) yields an 8.8 (High), implying a remote, low-complexity, unauthenticated bug needing only a victim to open a page. However, Google's own Chromium severity rating is explicitly 'Low', and the description states code execution occurs 'inside the sandbox' - i.e., this is a renderer-process memory-corruption bug (CWE-416 use-after-free) that does NOT by itself escape Chrome's sandbox. That containment is the single most important risk-reducing factor and is why the 8.8 numeric score materially overstates standalone real-world impact; realistic weaponization requires chaining this with a separate sandbox-escape bug. There is no EPSS score, no CISA KEV listing, and no evidence of public exploit code in the provided data, so there is no indication of active or imminent exploitation. No SSVC decision data was supplied. Net assessment: this is a patch-on-normal-cadence browser bug, not an emergency - genuinely important because Chrome is ubiquitous and UAF bugs are chainable, but the 'Low' vendor rating plus sandbox containment and absence of exploitation signals place it well below the priority its raw 8.8 suggests. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's WebAppInstalls component; a victim who simply visits the page causes the freed object to be reused, giving the attacker code execution within the renderer sandbox. Because execution is confined to the sandbox, a practical full-host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's WebAppInstalls component allows a remote attacker who convinces a victim to open a crafted HTML page to corrupt heap memory and potentially execute arbitrary code inside the renderer sandbox, affecting Chrome builds prior to 156.0.8078.47 on Windows, macOS, and Linux. Exploitation is constrained by two factors: the attacker has no path to trigger the bug without user interaction (UI:R, the victim must navigate to the malicious page), and the resulting code execution is sandbox-confined, so standalone impact is limited to the renderer process unless chained with a separate sandbox-escape primitive - which is why our assessed vector (C:L/I:L/A:L) is materially lower than the 8.8 base score derived from the C:H/I:H/A:H vector. Signals conflict sharply and must be read together: Google rates the flaw Chromium security severity Low and has shipped a fix in 156.0.8078.47, while the NVD-style vector implies full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the built-in updater (Settings → About Chrome, or the enterprise MSI/PKG/deb/rpm channel), then fully restart the browser so the new binary is loaded - confirm the running build at chrome://version, since a pending update that has not been relaunched leaves the vulnerable renderer in memory. Chromium-derived browsers and embedded frameworks must pick up their own builds containing the equivalent WebAppInstalls fix; there is no cross-vendor patch substitution. Because exploitation requires the victim to load attacker-controlled HTML, interim risk reduction is achievable by tightening the browsing surface rather than by a configuration toggle (no policy exists to disable WebAppInstalls specifically): restrict high-risk users to allowlisted sites, keep Site Isolation enabled (it bounds a renderer compromise to a single site instance and directly raises the cost of chaining this UAF with a sandbox escape, at some memory overhead), enforce the renderer sandbox without --no-sandbox or --disable-site-isolation-trials flags, and push the update through enterprise update policies with a short deadline so unpatched endpoints are not left browsing arbitrary content; blocking the install-prompt UI would not remediate the bug, since the flaw sits in the underlying handler rather than the user-facing prompt.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free), a memory-safety class in which an object is freed while a stale reference to it survives; a subsequent dereference through that dangling pointer reads or writes memory that the allocator may have already reassigned to attacker-influenced data. Here the dangling reference lives in the WebAppInstalls path of Chromium - the component that handles progressive web app / web app installation flows, including the installability checks, install dialog plumbing, and the Mojo/IPC messages that shuttle install requests between the renderer and the browser process. Because the freed object is reused through the WebAppInstalls handler reached from page-controlled content, a crafted HTML page can shape heap layout and turn the stale pointer into a controlled write, which in a V8/Blink renderer is the classic precursor to renderer-side code execution. Two contextual details matter for scoping: Google classifies the issue as Chromium severity Low (typically reflecting difficulty of reliable exploitation and the sandbox boundary), and the description explicitly states the code execution occurs inside the sandbox. Consequently the realistic exploitation chain is UAF → renderer compromise → a second, independent sandbox-escape bug for host compromise; without that chain the attacker gains code execution only with the renderer's privileges, which is why the authoritative assessment rates confidentiality, integrity, and availability impact as Low rather than High. The affected builds are those below 156.0.8078.47, and downstream Chromium-derived browsers that have not yet merged the corresponding upstream fix inherit the same defect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote, no auth, but requires visiting a page (UI:R) and execution is confined to the renderer sandbox (no scope change, limited direct impact), consistent with Google's Low rating.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop installations across the organization's Windows, macOS, and Linux estate below version 156.0.8078.47 carry a high-severity memory-corruption flaw in the WebAppInstalls component that a victim must be lured into triggering by visiting a crafted web page. Because successful code execution is confined to the browser's renderer sandbox, standalone business risk is bounded and recoverable rather than a direct path to endpoint takeover, though the flaw could be paired with a separate sandbox-escape to escalate. Leadership should care because the browser is the widest-deployed attack surface we operate, and the vendor has already shipped a fix, making this a routine patch-cadence obligation rather than an emergency - note that Google's own severity rating is Low while the 8.8 base score reflects a worst-case scenario, so effort should be proportionate to a fast, verifiable fleet-wide upgrade.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB