EUVD-2026-105660
GHSA-c5wh-36rq-2g6j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits crafted HTML page
-
ExploitMalicious media triggers use-after-free in Media component
-
ExecutionReclaim freed object to control memory
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML containing crafted media that triggers the use-after-free in Chrome's Media component (UI:R - user interaction via visiting a page is mandatory). No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected. The primary limiting factor is sandbox containment: the vendor states code execution occurs inside the renderer sandbox, so a separate sandbox-escape vulnerability would be required to reach the underlying host. Exploitation is further limited to Chrome builds prior to 156.0.8078.47. |
| Impact | This is a genuinely high-priority browser flaw but with an important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated bug requiring only that a victim open a crafted HTML page - the classic drive-by profile for Chrome. However, the vendor description explicitly states the code execution occurs 'inside the sandbox,' and the scope is Unchanged (S:U), meaning a successful exploit is contained within Chrome's renderer sandbox and would require a separate sandbox-escape chain to compromise the host. Note also a severity signal conflict: Google/Chromium rated this 'Medium' internally, while the assigned CVSS base score is 8.8 (High) - the CVSS figure does not discount sandbox containment, so treat the NVD-style 8.8 as an upper bound. No EPSS score, CISA KEV listing, SSVC decision, or POC indicator is present in the supplied data; accordingly there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: patch promptly as part of normal Chrome update hygiene, but this is not a confirmed in-the-wild emergency on the current evidence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious media content that triggers the use-after-free in Chrome's Media component. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, and the freed object is reused to achieve arbitrary code execution within the renderer sandbox. No public exploit code is identified in the supplied data, and full host compromise would require chaining this with a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A use-after-free in Chrome's Media component (CWE-416) lets a remote attacker who convinces a victim to open a crafted HTML page execute arbitrary code within the renderer sandbox on any Chrome build prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and default configurations are exposed, giving the flaw an 8.8 CVSS rating; Google rates Chromium security severity as Medium because the resulting code execution is confined to the sandbox, and reaching the host would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor has released a patched build.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later, available through the Chrome release channels described in the vendor advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html); verify the installed build via chrome://version and force the update through enterprise mechanisms such as Chrome Browser Cloud Management, Google Update policies, or your software deployment tooling, since browser auto-update can lag on managed fleets. There is no vendor-documented workaround for the media use-after-free itself, so the practical compensating controls are exposure reduction rather than feature disabling: keep the renderer sandbox and site isolation enabled (they are the reason this is rated Medium and disabling them would convert a sandboxed bug into host compromise), restrict browsing to trusted sites through URL filtering or a secure web gateway where policy permits, and consider tightening enterprise policies that block untrusted or uncategorized content for high-risk user groups, accepting the resulting usability trade-off. If Chrome cannot be patched immediately, prioritize updating users who routinely visit untrusted or user-generated content, and monitor the Chromium issue tracker for further detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in the Media subsystem of Google Chrome's Blink/Chromium rendering engine, the code path that handles HTML5 audio/video and related media pipeline objects. A use-after-free occurs when a heap-allocated media object is released while a reference to it is still held; the dangling pointer is then dereferenced, which an attacker can shape through heap grooming to redirect control flow. Because the crafted page is processed in the renderer process, the immediate consequence is arbitrary code execution inside Chrome's renderer sandbox rather than on the underlying operating system, which is why the vendor assigns only Medium Chromium severity despite the high CVSS base score. The affected component is the Chrome browser itself as distributed by Google; downstream Chromium-based browsers inherit the same media code and typically require their own updated builds. Per the vendor, the issue was reported through Google's Chrome CVE administration process and tracked in the Chromium issue tracker.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N, visiting the page is UI:R, sandbox-contained code execution keeps S:U with high C/I/A within the renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity use-after-free in the Media component that could allow a remote attacker to run code inside the browser's renderer sandbox if a user opens a crafted webpage. Because the flaw is sandbox-confined, requires user interaction, and has no public exploit or confirmed active exploitation identified at time of analysis, the immediate organizational risk is contained but still warrants prioritized patching across the Chrome estate. Leadership should care because Chrome is broadly deployed and unpatched browsers expose users to avoidable risk even when exploitation is not currently observed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB