EUVD-2026-105696
GHSA-cmwg-39v2-2cgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page with malicious WebFont
-
ExploitLure victim to visit page
-
ExecutionTrigger memory corruption in WebFonts parser
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using a Google Chrome desktop build prior to 156.0.8078.47 to visit an attacker-controlled web page containing a crafted WebFont (UI:R - user interaction via page visit is mandatory; there is no zero-click path). No authentication is required (PR:N). The decisive limiting factor is the sandbox: per the description, resulting code execution occurs INSIDE Chrome's renderer sandbox, so absent a separate sandbox-escape chain the attacker does not gain host-level code execution - this containment, together with the vendor's 'Low' severity rating, substantially constrains real-world impact despite the network attack vector. |
| Impact | Signals conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) implies a serious network-reachable, low-complexity, unauthenticated flaw with full CIA impact. However, the vendor itself rates this 'Chromium security severity: Low,' and critically the description states the arbitrary code executes INSIDE the sandbox (S:U, no scope change) - meaning no sandbox escape is claimed, which sharply limits real-world impact compared to what the 8.8 score suggests. No EPSS score, KEV listing, or POC is provided, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The gap between the high CVSS and the vendor's Low rating is the key tension: CVSS treats in-sandbox code execution as full C/I/A High, while the vendor accounts for the sandbox containing the damage. This is better characterized as a high-CVSS-but-vendor-low-severity issue rather than an urgent priority - but note Chrome's enormous footprint means even low-severity, patch-worthy flaws warrant prompt updating. Verify severity disposition against the vendor advisory before deprioritizing. |
| Exploit ScenarioDerived | A remote attacker crafts a malicious HTML page embedding a specially constructed WebFont and lures a victim into visiting it (UI:R - user interaction required). Rendering the crafted font triggers memory corruption (CWE-119) in Chrome's WebFonts handling, potentially allowing arbitrary code execution confined within the browser's renderer sandbox. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's WebFonts handling allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in any Chrome desktop build prior to 156.0.8078.47. The attack requires no authentication but is not zero-click - the victim must visit the attacker-controlled page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, 8.8), and Google rates the underlying Chromium bug as Low severity because any code execution achieved stays confined to the sandboxed renderer unless the attacker chains a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.
RemediationAI
Vendor-released patch: 156.0.8078.47 - upgrade Google Chrome to that build or later immediately via the built-in updater (chrome://settings/help), your OS package manager, or your software deployment tooling, and confirm the reported version after restart since Chrome applies updates on relaunch. Enterprise fleets can force the update through Google Update policy (UpdateDefault=1, shortened AutoUpdateCheckPeriodMinutes) or Chrome Browser Cloud Management, and should verify Chromium-derivative browsers have shipped their corresponding upstream revision. Where immediate upgrade is impossible, compensating controls are limited but real: keep the renderer sandbox, site isolation and, on Windows, RendererCodeIntegrityEnabled switched on so unsigned code cannot be injected into the renderer (trade-off: may break third-party accessibility or security hooks that rely on DLL injection); launch with --disable-remote-fonts to stop untrusted pages from supplying font data (trade-off: breaks icon fonts and web typography on legitimate sites, and is a per-instance flag rather than a managed policy); and constrain high-risk browsing to trusted origins or a throwaway profile until the fix is deployed. Details and the fixed version are documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in Chrome's WebFonts subsystem, the component that downloads and parses web-delivered font files (OpenType/SFNT and WOFF/WOFF2 containers) before handing glyph data to the text stack (OpenType Sanitizer, FreeType and HarfBuzz, with rasterization in Skia). Classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the defect is a classic sanitizer/parser miss: a malformed font table causes an out-of-bounds read or write in native renderer code, which an attacker can shape toward controlled memory corruption rather than a simple crash. Because font parsing occurs in the renderer process, the primitive is bounded by Chrome's site-isolation architecture - on Linux the seccomp-BPF sandbox, on macOS the Seatbelt profile, on Windows the restricted token/AppContainer plus optional renderer code integrity - so arbitrary code execution lands inside the sandbox and requires a second, independent escape bug to reach the host. The low Chromium severity rating reflects that containment and the requirement for a crafted font plus user navigation, even though the generic CVSS vector scores the theoretical unconstrained outcome at 8.8. Technical detail is tracked in Chromium issue 505807063 and the Chrome stable channel release notes for 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted HTML needs no privileges but requires the victim to open the page (UI:R); in-sandbox code execution yields high C/I/A with no scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop deployments prior to 156.0.8078.47 are exposed to a high-severity memory-corruption issue in WebFonts handling that could let a crafted page run code inside the browser's renderer sandbox. The attack requires a user to visit a malicious page and does not by itself escape the sandbox, and no public exploit identified at time of analysis, but the wide Chrome footprint and available fix make rapid verification a management priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB