EUVD-2026-105650
GHSA-25gw-qpff-qv3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious WebSocket JavaScript
-
ExploitTrigger use-after-free in WebSockets
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to navigate to attacker-controlled web content (UI:R) running a Chrome version prior to 156.0.8078.47; the crafted HTML page must exercise the WebSockets code path to trigger the use-after-free. No authentication or special privileges are needed (PR:N) and the attack works against default Chrome configurations. The key LIMITING factor is that resulting code execution is confined to the renderer sandbox (S:U) - meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability, substantially raising the real-world bar beyond the 8.8 score. |
| Impact | This is a genuinely high-priority patch-now issue by virtue of the product, though its raw CVSS of 8.8 overstates standalone impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a realistic condition for a web browser. However, the description explicitly states code execution occurs 'inside the sandbox,' and the scope is Unchanged (S:U), meaning a single exploit does not by itself escape to the host; it must be chained with a sandbox-escape bug to become full host compromise. Chromium itself rated the security severity as only Medium, which conflicts with the 8.8 NVD-style score - this gap is explained by the sandbox containment. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation-probability signals are absent rather than low; their absence should not be read as 'safe.' Given Chrome's ubiquity and the historical frequency with which renderer UAFs are chained, this warrants prompt patching despite the lack of confirmed exploitation. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that manipulates WebSocket objects to trigger a use-after-free in Chrome's WebSockets implementation. When a victim running a version prior to 156.0.8078.47 visits the page, the freed-then-reused memory is leveraged to execute arbitrary code within the renderer sandbox. No public exploit code was identified in the provided data, and full host compromise would require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's WebSockets implementation before 156.0.8078.47 enables remote code execution inside the renderer sandbox when a victim opens a crafted HTML page, requiring user interaction but no authentication. Google has released a vendor patch, and no public exploit or CISA KEV confirmation was identified at time of analysis. The raw 8.8 CVSS reflects high confidentiality, integrity, and availability impact within the renderer, but standalone host compromise would require chaining a separate sandbox-escape vulnerability, so the score overstates standalone impact even though the product makes this a high-priority patch-now issue.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later and restart the browser to apply the update, verifying the version via chrome://settings/help; managed fleets should use Google Update or Chrome Enterprise policies to force the fixed build. The vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is https://issues.chromium.org/issues/560939312. If immediate upgrade is not possible, reduce exposure by preventing users from browsing untrusted web content and by restricting or monitoring WebSocket traffic through enterprise proxies, recognizing that blocking WebSockets can break legitimate applications, and enforce site isolation as a defense-in-depth control while acknowledging it does not remove the underlying use-after-free and host compromise still requires a separate sandbox escape.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's WebSockets handling. WebSockets establish a persistent, bidirectional channel between browser JavaScript and a server; during message, frame, or connection lifecycle handling, a freed object can be accessed through a dangling pointer, causing memory corruption that a crafted HTML page can steer into arbitrary code execution inside the renderer sandbox. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a network-reachable, unauthenticated attack that requires victim interaction and remains scoped to the renderer; escaping to the host operating system would require a separate sandbox-escape bug. The supplied tags include RCE, denial of service, Google, use-after-free, and memory corruption, while ENISA EUVD tracks the issue as EUVD-2026-105650. No CPE strings were provided in the input, but EUVD lists affected Chrome versions below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; victim must load the page so UI:R; code execution stays in the renderer sandbox so S:U with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome releases before 156.0.8078.47 are exposed to a WebSockets use-after-free that can let a crafted web page run code inside the browser renderer sandbox when a user interacts with it. This is a broad workforce exposure because Chrome is widely used, but standalone compromise of the host would require an additional sandbox-escape flaw, and no public exploit identified at time of analysis, so leadership should prioritize rapid patching rather than incident response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB