EUVD-2026-105758
GHSA-x752-m587-qcqp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits attacker-controlled page
-
ExploitDeliver crafted media in HTML
-
ExecutionTrigger use-after-free in Media component
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47 on Windows), per UI:R in the CVSS vector - there is no fully automatic, interaction-free path. The affected code is the Media component, so media handling must process the malicious content. Critically, successful code execution is confined to the renderer sandbox per the description, so a separate sandbox-escape chain is needed for host-level compromise - this is the primary limiting factor and the basis for the Chromium 'Low' rating. Exploitation is further limited to Windows builds and to users who have not yet received the auto-update fix. |
| Impact | Signals are mixed and should be read carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - on paper a high-priority renderer RCE. However, the description explicitly scopes the outcome to arbitrary code execution INSIDE the Chrome sandbox, and Google/Chromium rated this 'Low' severity, which directly conflicts with the 8.8 base score. This gap is the key tension: full host compromise would require chaining a separate sandbox-escape bug, so standalone real-world impact is materially lower than 8.8 implies. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active exploitation - treat as 'no public exploit identified at time of analysis.' Net: a legitimate memory-safety RCE in a ubiquitous product that warrants prompt patching via normal Chrome auto-update, but not an emergency relative to its headline CVSS, given sandbox containment, the Chromium 'Low' rating, and absence of exploitation signals. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted media content that triggers a use-after-free in Chrome's Media component when the victim visits it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox; meaningful host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Media component on Windows (versions prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so host-level compromise would require a separate sandbox-escape chain; Chromium rates the issue Low despite high CVSS impact metrics. A vendor patch is available, and no public exploit code was identified at time of analysis.
RemediationAI
Upgrade Google Chrome on Windows to 156.0.8078.47 or later via the stable channel; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the associated Chromium issue is https://issues.chromium.org/issues/563003907. Confirm the installed version through chrome://settings/help or enterprise version reporting and restart the browser after updating. Because exploitation requires loading a crafted HTML page, interim risk reduction centers on preventing users from reaching untrusted content, such as restricting browsing to approved sites or isolating risky web use while the update is deployed; Chrome's renderer sandbox limits impact to the sandboxed process but does not remove the underlying memory-safety flaw. No vendor workaround beyond updating is identified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Media component, which handles parsing and rendering of HTML media content. A lifetime or ownership error can leave a dangling pointer that a crafted HTML page causes to be reused, potentially redirecting execution within the renderer process. Because the compromised context is the sandboxed renderer, arbitrary code execution is contained there unless chained with a sandbox escape; the Windows-only scope and required page load are consistent with the independent assessment's AC:H/UI:R vector and Chromium's Low severity rating. The associated Chromium issue is https://issues.chromium.org/issues/563003907, referenced by the vendor stable-channel advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N, UI:R, PR:N); use-after-free exploitation typically depends on heap/timing conditions (AC:H); impacts scored high within the compromised renderer though sandbox-contained.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome on Windows endpoints prior to version 156.0.8078.47 carries a use-after-free flaw in the Media component that a remote attacker could trigger through a crafted web page, potentially allowing code execution inside the browser's renderer sandbox. Because exploitation requires a user to visit a malicious page and the sandbox contains the impact, host-level compromise would demand a separate sandbox-escape chain, so leadership exposure is concentrated in browser-dependent workforce activity rather than broad enterprise systems. No public exploit code was identified at time of analysis, and the vendor has already shipped a fix, making this a patch-cadence issue rather than a crisis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB