EUVD-2026-105735
GHSA-58pg-4r4w-gphv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
ExploitServe crafted HTML page
-
ExecutionTrigger memory corruption in HTML parsing
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user running Google Chrome prior to 156.0.8078.47 to open or visit an attacker-controlled crafted HTML page (UI:R / user interaction required); no authentication or prior privileges are needed. The key limiting factor is that resulting code execution is confined to the browser's renderer sandbox (S:U, 'inside the sandbox' per the vendor) - a separate sandbox-escape vulnerability would be required to compromise the underlying host, so impact is bounded to the renderer process absent a chain. User interaction and the sandbox boundary are the primary constraints reducing realistic risk below the raw 8.8 score. |
| Impact | Signals are mixed and should be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a page), which on its face looks high priority. However, the description explicitly states code execution occurs 'inside the sandbox,' and the scope is Unchanged (S:U) - meaning this is renderer-process compromise without a demonstrated sandbox escape, which materially lowers real-world impact versus a full host takeover. There is also a direct conflict in the input: Google's own Chromium security severity is rated 'Low,' yet the CVSS base score is 8.8 (High) - this discrepancy should be flagged to stakeholders, as the vendor's qualitative rating reflects the sandbox containment while the CVSS C/I/A:H values reflect in-process impact. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was indicated; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: a legitimately patch-worthy browser bug, but the absence of a chained sandbox escape plus the vendor's 'Low' rating argue this is standard-cadence patching rather than an emergency, pending any future KEV/EPSS signal. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a victim running a vulnerable Chrome build (prior to 156.0.8078.47) to open it, for example via a phishing link or a malicious ad. The page triggers the memory-corruption condition (CWE-119) in Chrome's HTML handling, letting the attacker run arbitrary code within the browser's renderer sandbox. No public exploit was identified at time of analysis, and the attacker would still need a separate sandbox-escape bug to reach the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the HTML handling component of Google Chrome prior to 156.0.8078.47 lets a remote attacker trigger a buffer-related fault and potentially execute arbitrary code, though strictly inside the renderer sandbox. Affected users are those running Chrome builds older than 156.0.8078.47 across desktop platforms; exploitation requires the victim to open a crafted HTML page (UI:R) and needs no credentials or prior privileges. Google rates the issue Low on its Chromium severity scale despite the 8.8 CVSS, and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical ceiling on impact is the sandbox boundary, so host compromise would need a separate sandbox-escape chained in.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later - this is the exact fixed build named in the stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html), and Chrome's auto-update will normally stage it, so verify via chrome://settings/help that the reported version is at or above 156.0.8078.47 and force a relaunch if an update is pending. Chromium-based downstream browsers and embedded frameworks built on the older revision should be updated once their maintainers publish an equivalent fix. Where immediate upgrade is impossible, restrict exposure by disabling or hardening JavaScript/JIT-dependent rendering through enterprise policy (DefaultJavaScriptSetting) - accepting that many internal web applications will break - and enforce site isolation plus out-of-process renderer sandboxing so any successful corruption remains contained; block untrusted or uncategorized sites via URL filtering and tighten Safe Browsing enforcement to reduce the chance of a user reaching a crafted page, since the attack requires a deliberate page visit (UI:R). Track the Chromium issue at https://issues.chromium.org/issues/553335083 for confirmation of the fix and any backport details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-119 (improper restriction of operations within the bounds of a memory buffer) in Chrome's HTML parsing/rendering path, meaning malformed markup can drive out-of-bounds reads or writes in browser code - the tag set (RCE, Buffer Overflow) and the vendor's 'memory corruption in HTML' wording align with that reading. Because the fault sits in the renderer, successful corruption can yield code execution as the sandboxed renderer process; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) captures remote reachability, no privileges required, mandatory user interaction, and high confidentiality/integrity/availability impact on that renderer component, with scope unchanged. Google's Chromium severity rating of Low, contrasted with the 8.8 base score, reflects both the sandbox containment and the difficulty of turning the corruption into reliable control flow. The relevant CPE/version boundary is Chrome builds below 156.0.8078.47, tracked under EUVD-2026-105735 and Chromium issue 553335083.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted HTML with low complexity and no auth, but requiring the victim to open the page (UI:R); scope stays Unchanged as execution is sandbox-confined.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop users on builds older than 156.0.8078.47 face a memory-corruption exposure in HTML handling that could let an attacker run code inside the browser's renderer sandbox after a user opens a crafted page. The sandbox boundary and the fact that no public exploit was identified at time of analysis limit near-term business risk, but the wide desktop footprint and available fix warrant prompt fleet-wide remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB