EUVD-2026-105551
GHSA-4p72-9g98-cg47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
DeliveryServe crafted HTML page
-
ExploitTrigger Sensor memory corruption
-
ExecutionExecute code within renderer sandbox
-
ImpactChain sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Chrome build (prior to 156.0.8078.47) and to actively visit or render attacker-controlled HTML (UI:R) that exercises the Sensor component - no authentication or special configuration is needed (PR:N), and default Chrome installations are affected. The primary limiting factors are: (1) mandatory user interaction (the victim must open the malicious page), and (2) the Chromium renderer sandbox, which confines any resulting code execution and forces an attacker to chain a separate sandbox-escape bug to achieve host-level compromise. No non-default feature or setting is named as a prerequisite. |
| Impact | The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity flaw requiring no privileges but one user action (visiting a page). However, two signals pull real-world priority down. First, the description explicitly scopes code execution to 'inside the sandbox' and the vector sets S:U (scope unchanged), meaning this flaw alone does not escape the Chromium renderer sandbox and must be chained with a separate sandbox-escape to compromise the host - the C:H/I:H/A:H therefore reflects renderer-process impact, not host takeover. Second, Google/Chromium internally rated this 'Medium' severity, which conflicts with the 8.8 (High) CVSS score; this gap suggests the NVD-style vector overstates practical impact for a sandboxed renderer bug. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate memory-corruption vulnerability worth patching promptly given Chrome's reach, but currently a normal-cadence patch item rather than an emergency, absent a KEV listing, a known exploit chain, or a rising EPSS signal. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that abuses the Sensor component to trigger memory corruption in a victim's Chrome renderer process. When the victim visits the page (UI:R), the attacker can potentially execute arbitrary code confined to the browser sandbox; full system compromise would additionally require chaining a separate sandbox-escape vulnerability. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Sensor component prior to version 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network reachable, low complexity, no privileges required, but contingent on one user action (opening the page) - and Google classifies it as Chromium security severity Medium. Because the corruption occurs in the sandboxed renderer, any code execution is confined there; achieving host-level compromise would require the attacker to additionally chain a separate sandbox-escape bug. No public exploit code has been identified at the time of analysis, and the issue was fixed by the Chrome stable channel update.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, delivered through the built-in updater (chrome://settings/help) or the platform package manager on Linux, and confirm the version after restart. Enterprise fleets should force the update via their update/patch management tooling and verify compliance across the installed base, then review the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue at https://issues.chromium.org/issues/513620385 for any platform-specific notes. No configuration toggle removes the underlying memory-safety bug, so until patch coverage is complete the practical controls are: keep the Chromium renderer sandbox and Site Isolation enabled (both default) so that any successful corruption stays renderer-confined - the trade-off is that this is containment, not prevention; where a managed policy exists to block site access to device sensors, restricting sensor permissions for untrusted sites removes the exposed attack surface at the cost of breaking legitimate sensor-driven web applications; and constrain browsing of untrusted or attacker-supplied HTML (mail attachments, links in unsolicited messages) through web filtering or forced-opening policies, which reduces exposure but does not eliminate it for users who must browse broadly. Note that the user-interaction requirement (UI:R) makes user awareness of crafted-page lures a meaningful secondary control, and that because exploitation stays inside the sandbox, host-level detection should focus on anomalous renderer crashes and any subsequent sandbox-escape indicators rather than on the initial corruption alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Chromium's Sensor implementation, the browser-side plumbing behind the web Sensor APIs (motion/orientation sensors such as Accelerometer and Gyroscope, plus environmental sensors), which feed device sensor data into page-accessible JavaScript objects under secure-context and permission rules. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates an out-of-bounds memory access - typically a heap overflow or out-of-bounds write/read - triggered while processing data in that component, with the crafted HTML page acting as the delivery vector for malformed input. The consequence is memory corruption in the renderer process that can be shaped into arbitrary code execution at renderer privilege; the Chromium sandbox then constrains the blast radius unless a second, independent sandbox-escape vulnerability is chained. Per the CVSS vector, the attack is unauthenticated (PR:N) and requires user interaction (UI:R), with high confidentiality, integrity and availability impact (C:H/I:H/A:H) and an unchanged scope (S:U), matching a renderer-confined compromise. The public Chromium issue entry (issues.chromium.org/issues/513620385) is referenced for technical detail, and Google's advisory does not disclose the specific faulting function, consistent with its practice of withholding exploit-relevant detail until most users have patched.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires visiting the page (UI:R); code execution stays in the sandbox so scope is unchanged (S:U) with high renderer-process C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity memory-corruption weakness in the Sensor component that could let a remote unauthenticated attacker execute code inside the browser sandbox when a user opens a crafted page, though host compromise would require chaining a separate sandbox escape. Leadership should care because routine web browsing exposes the organization's Chrome user base, and although no public exploit has been identified at time of analysis, unpatched browsers remain a scalable target for later exploit chains; the vendor has released a fixed build.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB