EUVD-2026-105647
GHSA-x5qx-532r-2q79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage loads malicious media content
-
ExploitTrigger use-after-free in Media component
-
ExecutionReclaim freed object and execute code
-
ImpactArbitrary code execution within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome built before 156.0.8078.47 and to load attacker-controlled HTML that drives the vulnerable Media component into the use-after-free state (UI:R - user must open the page). No authentication is required (PR:N). The principal limiting factor is that successful exploitation yields code execution only inside the renderer sandbox; escaping to the host requires chaining a separate sandbox-escape vulnerability. Patched builds (156.0.8078.47 and later) are not affected. |
| Impact | Signals are moderately consistent but incomplete. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a realistic bar for a browser. However, the Chromium team rated the security severity only 'Medium', and the description explicitly states code execution occurs 'inside the sandbox,' meaning a single bug yields only renderer-process compromise, not full host takeover without a separate sandbox-escape chain. That caveat tempers the headline 8.8. No EPSS score, SSVC decision data, KEV listing, or POC was provided, so exploitation probability and framework-based prioritization cannot be computed from the input. Per the input, this is neither in CISA KEV nor flagged with public exploit code, so status is 'no public exploit identified at time of analysis.' Net: patch promptly given ubiquitous deployment and easy delivery vector, but the sandbox-contained impact and 'Medium' vendor rating argue this is not an emergency single-bug RCE on par with a sandbox-escaping zero-day. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing media content crafted to trigger the use-after-free in Chrome's Media component, then lures a victim to visit it (UI:R). When the page loads, the freed object is reused, giving the attacker arbitrary code execution within the renderer sandbox. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Media component allows remote code execution inside the renderer sandbox when a victim opens a crafted HTML page in versions prior to 156.0.8078.47. No authentication is required, but exploitation requires user interaction, and code execution is confined to the sandbox unless chained with a separate sandbox escape. Chrome 156.0.8078.47 fixes the issue; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and assessment signals are moderately consistent but incomplete.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later through the stable channel and restart the browser; verify the installed version via chrome://version. The vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites and blocking untrusted HTML content, and keep Chrome's renderer sandbox enabled (do not run with --no-sandbox); these are partial mitigations that reduce attack surface but do not remediate the underlying use-after-free. No specific workaround beyond updating was provided in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in Google Chrome's Media component, which handles audio/video playback and associated media pipeline processing. A use-after-free occurs when memory is freed but a stale pointer is later dereferenced, potentially allowing an attacker to control memory contents and redirect execution. Because the vulnerable code runs in the renderer process, successful exploitation yields code execution inside Chrome's sandbox; compromising the host requires chaining a separate, distinct sandbox-escape vulnerability. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network-reachable attack delivery, no authentication requirement, mandatory user interaction (opening a crafted HTML page), and high confidentiality, integrity, and availability impact within the sandboxed renderer context.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N, AC:L, PR:N) requiring victim navigation (UI:R); UAF enabling in-renderer code execution gives high C/I/A with no scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's Media component contains a high-severity flaw that could allow code execution in a user's browser renderer when a crafted webpage is opened, affecting organizations with unpatched Chrome deployments. The business risk is broad because Chrome is widely used, though impact is partly limited by the browser sandbox and required user interaction; leadership should prioritize rapid fleet remediation because any future exploit chain could increase exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB