EUVD-2026-105718
GHSA-cj7c-rhhh-cqh5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser visits attacker-controlled page
-
ExploitServe crafted HTML/JS payload
-
ExecutionTrigger use-after-free in Input component
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in Chrome - specifically to visit or be redirected to a crafted HTML page (CVSS UI:R), so user interaction is a hard prerequisite and there is no server-side or zero-click path. No authentication or special privileges are needed (PR:N). Critically, the vulnerability yields code execution only INSIDE the renderer sandbox (S:U, no stated escape), so full host compromise additionally requires chaining a separate sandbox-escape vulnerability - this containment is the primary limiting factor. Affected deployments are Chrome desktop builds prior to 156.0.8078.47; fully patched/auto-updated installs are not exposed. |
| Impact | Signals are mixed and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated bug needing only user interaction - the classic 'malicious web page' profile that normally warrants high priority given Chrome's install base. However, two factors pull the real-world severity down sharply and conflict with the raw 8.8: (1) the description explicitly states code execution occurs 'inside the sandbox,' i.e. the compromised renderer is still confined by Chrome's sandbox and there is NO stated sandbox escape, so the 8.8 arguably overstates true impact (the CVSS Scope is correctly Unchanged, S:U, consistent with containment); and (2) Google rated the Chromium security severity as 'Low,' which is unusual for a renderer UAF and reinforces that exploitation value is limited absent a chained escape. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified - this is a data gap, not evidence of safety. Net assessment: patch-worthy as part of normal Chrome auto-update hygiene, but this is a high-CVSS / lower-real-risk item in isolation (sandbox-contained, vendor-rated Low, no evidence of active exploitation) rather than an emergency; priority would rise materially only if combined with a separate sandbox-escape bug. |
| Exploit ScenarioDerived | A remote attacker lures a user to a crafted or compromised web page; the malicious HTML/JavaScript triggers a use-after-free in Chrome's Input component, corrupting memory in the renderer process. The attacker achieves arbitrary code execution within the renderer sandbox, but remains confined unless a separate sandbox-escape is chained. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Input handling prior to 156.0.8078.47 enables remote code execution inside the browser sandbox when a user opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the assessed impact is contained to the renderer sandbox; full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 to address the flaw.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later, then restart the browser and verify the installed version; enterprise administrators should force the update through their software-management or browser-update policies. The vendor advisory is available at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is at https://issues.chromium.org/issues/533113044. If immediate upgrade is not possible, reduce exposure by restricting browsing to trusted sites, routing untrusted web content through enterprise browser isolation, and ensuring the Chromium renderer sandbox remains enabled; these measures lower likelihood but do not remediate the underlying use-after-free. No vendor-released patch version other than 156.0.8078.47 was identified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Input component. This class of memory-corruption bug occurs when an object is freed but a stale pointer is later dereferenced, allowing an attacker to influence reused memory and potentially achieve arbitrary code execution. The attack surface is a crafted HTML page processed by the Chrome renderer; because the renderer runs inside the Chromium sandbox, code execution is constrained to that sandbox unless a second, independent sandbox-escape vulnerability is exploited. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a score of 8.8 due to high confidentiality, integrity, and availability impact, while Google's Chromium severity rating for this issue is Low and the scope remains unchanged (S:U), consistent with renderer-only containment.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page reachable by any unauthenticated visitor gives AV:N/AC:L/PR:N, user must open the page (UI:R), and code runs within the renderer so scope is Unchanged (S:U) with high renderer-level C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity use-after-free that can allow a crafted web page to execute code inside the browser's renderer sandbox after a user opens it. Because Chrome is broadly deployed, unpatched endpoints expose users to session disruption and potential data exposure, though full device compromise would require an additional sandbox escape. No public exploit was identified at time of analysis and the vendor has released a fixed version, so leadership should prioritize verified update coverage across the fleet.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB