EUVD-2026-105507
GHSA-gpch-93vr-h37r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger use-after-free in Streaming component
-
ExploitReuse freed object to control execution
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for full compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to navigate a vulnerable Chrome desktop build (any version prior to 156.0.8078.47) to attacker-controlled web content that triggers the use-after-free in the Streaming component - this user interaction (UI:R) is the primary limiting factor; no authentication, no special configuration, and no non-default setting is required. The resulting code execution is confined to the renderer sandbox (scope unchanged), so a separate sandbox-escape vulnerability is required before the attacker can affect the underlying operating system, which materially limits standalone impact. |
| Impact | This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a realistic bar for a web browser. However, two signals temper the raw score: Google rated the Chromium security severity as Medium (not High/Critical), and the description explicitly states code execution occurs 'inside the sandbox' with scope unchanged (S:U), meaning a separate sandbox-escape bug is needed for full host compromise. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced, so this is no public exploit identified at time of analysis - do not treat it as actively exploited. Net: a genuine memory-corruption RCE in ubiquitous software that warrants prompt patching, but the sandbox-confinement and Medium Chromium rating argue against treating it as a drop-everything, in-the-wild threat absent further exploitation data. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious content that triggers the use-after-free in Chrome's Streaming component. A victim using a vulnerable Chrome build (before 156.0.8078.47) visits the page, and the freed-then-reused object lets the attacker execute arbitrary code within the renderer sandbox. No public proof-of-concept is referenced, and full system compromise would still require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Code execution inside the renderer sandbox is achievable in Google Chrome desktop builds prior to 156.0.8078.47 through a use-after-free in the Streaming component. A remote, unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted HTML page, but the CVSS vector requires user interaction (UI:R) and the resulting code execution remains confined to the renderer sandbox, so a separate sandbox escape is needed to compromise the host. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later through chrome://settings/help or an enterprise software-deployment channel, then restart the browser so the new build is active; the vendor advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium bug is https://issues.chromium.org/issues/499869964. Until the update is deployed, restrict users from browsing untrusted web content and enforce browser update policies, recognizing that these are only temporary risk reductions and can disrupt legitimate workflows. Keep Site Isolation and the renderer sandbox enabled because they limit standalone impact if the use-after-free is triggered, but they do not remediate the underlying memory-corruption flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chromium's Streaming component, which is part of Chrome's renderer-side web content handling. In this class of bug, an object is freed while a stale reference to it remains; attacker-controlled HTML can manipulate object lifetime so the dangling pointer is reused, corrupting memory and potentially redirecting execution flow. Because the vulnerable code runs in the renderer process, successful exploitation yields code execution inside Chrome's sandbox rather than at the operating-system level; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a remote, unauthenticated attack that requires the victim to visit attacker-controlled content. No CPE identifiers were provided, so product matching depends on the Chrome release version rather than a CPE string.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs only a victim visit, so AV:N/AC:L/PR:N/UI:R; code runs inside the sandbox without escape, so S:U with full C/I/A impact in the renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop deployments prior to 156.0.8078.47 are exposed to a high-severity code-execution vulnerability in the Streaming component, with a vendor patch now available and no public exploit identified at time of analysis. The flaw requires user interaction and is limited to the renderer sandbox unless chained with a separate sandbox escape, but widespread Chrome use across the workforce makes prompt remediation important to reduce avoidable exposure and support compliance.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB