EUVD-2026-105491
GHSA-g2h6-84j6-p4xq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
ExploitDeliver crafted HTML/JS targeting FileSystem
-
ExecutionTrigger memory corruption (buffer overflow)
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome before version 156.0.8078.47 to load attacker-controlled web content that exercises the FileSystem component (UI:R - the user must visit or be redirected to the crafted HTML page; no clicking beyond navigation is implied). No authentication or special privileges are needed (PR:N), and default configurations are affected. The principal LIMITING factor is that resulting code execution is confined to the renderer sandbox, so real-world host compromise requires chaining a separate sandbox-escape vulnerability; user interaction (page visit) is also mandatory, ruling out fully passive or server-side mass exploitation. |
| Impact | Signals are mixed, leaning toward elevated but not top-tier urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - the classic drive-by browser profile. However, two signals pull the real-world risk down: (1) the description explicitly scopes code execution to 'inside the sandbox,' meaning this alone does not yield host compromise without a separate sandbox-escape bug to chain against, and (2) Google/Chromium rated the security severity 'Medium,' which is notably below what the 8.8 CVSS might suggest. There is no EPSS score, no CISA KEV listing, and no indication of public POC in the provided data, so exploitation probability cannot be quantified and nothing points to active exploitation. The 'RCE' tag overstates impact - true RCE would require escaping the sandbox, which this CVE does not claim. Net: a patch-promptly browser bug that is realistically dangerous mainly as one link in an exploit chain, not a standalone critical. Verify the Chromium bug tracker (issues.chromium.org/497482008) for disclosure/exploitation details, which were restricted at time of analysis. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing JavaScript/HTML that abuses the Chrome FileSystem component to trigger a memory-corruption (buffer) condition. A victim running an unpatched Chrome (before 156.0.8078.47) simply navigates to or is redirected to the page, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit identified at time of analysis; weaponization would typically require pairing this with a separate sandbox-escape vulnerability to affect the underlying host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Chrome FileSystem component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 on desktop are affected, and because exploitation requires only a page visit (UI:R) with no privileges (PR:N), browsing-driven attacks are practical despite the medium rating Chromium assigned. Code execution is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later via the stable channel; the vendor confirms a patch is available and the release notes at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html detail the fix. Prioritize browser auto-update enforcement and verify the deployed version across managed fleets, since exploitation needs only a crafted page load by an unauthenticated remote attacker. Where immediate upgrade is impossible, reduce exposure with compensating controls and accept their trade-offs: enforce Chrome's site isolation and sandboxing (already default, but confirm no launch flags such as --no-sandbox or disabled site isolation weaken them), restrict navigation to untrusted sites through enterprise URL blocklisting or proxy categorization, and disable or gate the File System Access API via the FileSystemAccessAPI / related enterprise policies - noting this can break legitimate web applications that rely on file and directory pickers. Running browsers in a hardened, low-privilege container or with reduced local data exposure limits post-exploitation impact but does not prevent the initial renderer corruption. Monitor the Chromium issue tracker (https://issues.chromium.org/issues/497482008) for updates and align any Chromium-based browser deployments with the equivalent upstream fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer located in Chrome's FileSystem implementation - the Blink/Chromium layer that backs File and Directory API operations for web content (file and directory handles exposed to pages). Because the component parses and manipulates attacker-influenced data structures on behalf of a web page, a bounds-calculation or lifetime error lets a crafted HTML document corrupt memory in the renderer process. Under the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H the attacker needs no credentials and the only precondition is victim navigation to hostile content, yielding high confidentiality, integrity and availability impact within the compromised renderer. The scope is unchanged (S:U), reinforcing that the corruption and resulting code execution remain inside Chrome's renderer sandbox and do not by themselves cross a privilege boundary to the operating system.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but mandatory victim navigation (UI:R); sandbox contains impact to the renderer so S:U with high C/I/A on that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop builds earlier than 156.0.8078.47 carry a memory-corruption flaw in the FileSystem component that can let a crafted web page execute code inside the browser's renderer sandbox. This affects employees who browse with unpatched Chrome; while full host takeover would require an additional sandbox escape and no public exploit identified at time of analysis, a single page visit can still compromise browser-scoped data and create a foothold for further attack chains. Leadership should prioritize remediation because vendor-released patch: 156.0.8078.47 is available and Chrome's broad footprint makes even sandbox-contained code execution a material business risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB