EUVD-2026-105636
GHSA-q29j-8cc9-vrx4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
ExploitDeliver crafted HTML triggering DevTools
-
ExecutionExploit use-after-free (CWE-416)
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively navigate to an attacker-controlled web page containing crafted HTML that exercises Chrome's DevTools code path (UI:R - user interaction is mandatory, so this is not driveby-silent against a passive target beyond page load). No authentication is required (PR:N) and no special non-default Chrome configuration is indicated. The key LIMITING factor is that resulting code execution is confined to the browser sandbox (S:U, 'inside the sandbox' per the description); a separate sandbox-escape vulnerability would be needed to compromise the host OS. Affected: Google Chrome versions prior to 156.0.8078.47; updating to that build removes the condition. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a low-complexity, network-reachable, unauthenticated flaw requiring only user interaction (visiting a crafted page). However, several signals temper the raw score: the description explicitly scopes code execution to 'inside the sandbox' (S:U, no scope change), meaning this is NOT a full sandbox-escaping remote code execution - an attacker gains execution in the constrained renderer/DevTools context, not the host OS. This is corroborated by Google's own 'Chromium security severity: Medium' rating, which conflicts with the 8.8 'High' CVSS; the vendor's Medium rating better reflects the sandbox containment. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is neither confirmed actively exploited nor known to have a POC. Net assessment: a legitimately serious memory-corruption bug in an ubiquitous product that warrants prompt patching, but the sandbox containment plus absence of KEV/POC/EPSS signals place it below drop-everything priority - closer to routine-but-timely Chrome patch cadence than an emergency. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted HTML that interacts with Chrome's DevTools code path, and lures a victim into visiting it. When the page loads, a use-after-free is triggered in DevTools, letting the attacker execute arbitrary code within the browser sandbox. No public exploit code has been identified, and the attacker would still need a separate sandbox-escape bug to reach the underlying OS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's DevTools component (all versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the browser sandbox by convincing a victim to load a crafted HTML page that drives the vulnerable DevTools code path. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and no privileges required, tempered only by the mandatory user interaction of visiting the attacker's page and by the fact that execution is confined to the renderer sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium security severity as Medium despite the high CVSS base score.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, and force the update through your management console rather than relying on user-initiated restarts (a restart is required for the new binary to take effect, and un-restarted sessions remain exploitable). Verify the installed build on endpoints and confirm Chromium-derived browsers have rebased to the same version. If immediate fleet-wide upgrade is not possible, the highest-value compensating control is to block untrusted web content and newly registered or uncategorized domains at the secure web gateway and DNS layer, which reduces exposure to the crafted page that must be loaded to trigger the bug - trade-off: this breaks legitimate browsing to those categories and requires an allowlist for business-critical sites. Applying Chrome enterprise policies to disable or restrict DevTools availability (DeveloperToolsAvailability = 2, blocking DevTools on all sites) reduces reachable attack surface for this specific component - trade-off: it removes a debugging tool developers and support staff may depend on, and it does not remove the underlying memory-safety bug. Enabling Chrome's site isolation and keeping the renderer sandbox enforced limits any successful exploitation to the sandbox boundary the CVE already describes, so treat those as damage limitation, not a fix. Because no public exploit code was identified at time of analysis, prioritization should follow standard high-severity browser patching cadence rather than emergency out-of-band response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free), a memory-corruption class in which a heap object in the browser's DevTools subsystem is freed while a dangling reference to it is still reachable; subsequent use of that pointer lets an attacker redirect control flow through corrupted vtable/function pointers or adjacent heap structures. DevTools is a privileged, heavily scripted inspection surface that parses page content, network activity, and protocol messages (the Chrome DevTools Protocol), making it an unusually attractive target for heap-shaping attacks. The relevant attack surface is reachable from renderer-side content via a crafted HTML page, which is why the vector requires only UI:R rather than any credentials or local access. Exploitation stays within the Chrome sandbox boundary (S:U), so impact to the operating system is not implied by this CVE alone. Affected CPE scope is Google Chrome builds below 156.0.8078.47 on desktop channels; the vendor advisory at chromereleases.googleblog.com (Stable Channel Update for Desktop, October 2026) is the authoritative source, with the underlying engineering record at issues.chromium.org/issues/553931271 tracked as a restricted bug.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with required user interaction (UI:R, PR:N, AC:L); scope unchanged because execution stays within the sandbox (S:U), with high C/I/A within that context.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome releases prior to 156.0.8078.47 contain a use-after-free flaw in the browser's built-in developer tools that can let a malicious web page run attacker-supplied code inside the browser on any employee workstation. Because Chrome is the default or primary browser across most of the workforce, the exposure is broad rather than confined to engineering or developer populations, and a single crafted page visit is enough to trigger the vulnerable path. The practical ceiling is currently limited by Chrome's renderer sandbox and by the absence of observed exploitation, so leadership should treat this as a patch-cadence discipline issue rather than an active incident.
Apply vendor patch. Until the fixed build reaches every endpoint, enforce browser auto-update, block known-malicious domains at the secure web gateway, and restrict administrative browsing on high-value systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB