EUVD-2026-105742
GHSA-xm7f-8pww-7583
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious media content
-
ExecutionTrigger use-after-free in Media component
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively navigate to an attacker-controlled web page that serves crafted media content processed by Chrome's Media component (UI:R - user interaction is mandatory, which limits mass unattended exploitation). No authentication is required (PR:N). The critical limiting factor is sandbox containment: per the description, arbitrary code executes only 'inside the sandbox,' so a successful exploit does not by itself compromise the host and would need to be chained with a separate sandbox-escape vulnerability for full system impact - this is the basis for Google's 'Low' Chromium severity rating. Affects Chrome desktop versions prior to 156.0.8078.47. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The NVD CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) frames this as a high-severity remote code execution flaw, yet Google's own Chromium security team rated it 'Low' severity - a deliberate divergence driven by the description's key qualifier: code executes 'inside the sandbox.' A renderer-sandbox-confined use-after-free (CWE-416) is not directly system-compromising; it typically requires chaining with a separate sandbox-escape bug to achieve meaningful host impact, which is precisely why Google downgraded it. No EPSS score, SSVC decision data, KEV listing, or POC reference is present in the supplied intelligence, so there is no evidence of exploitation probability or active abuse - status is 'no public exploit identified at time of analysis.' Net assessment: this is a patch-on-normal-cadence browser bug, not an emergency. The headline 8.8 overstates real-world risk for this specific issue because it does not model the sandbox containment that the vendor explicitly flagged. Treat Chrome's ubiquity - not this CVE's raw score - as the reason to patch promptly. |
| Exploit ScenarioDerived | A remote attacker hosts a malicious or compromised web page containing crafted media content and lures a victim into visiting it (UI:R). When Chrome's Media component processes the content, a use-after-free is triggered, letting the attacker execute arbitrary code within the renderer sandbox. No public exploit code is identified in the supplied data, and sandbox containment means a further sandbox-escape would be needed for full host compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote code execution confined to Chrome's renderer sandbox can be triggered in Google Chrome desktop builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that drives a use-after-free in the Media component. Exploitation is unauthenticated over the network but requires user interaction (CVSS:3.1/PR:N/UI:R), and because code execution stays 'inside the sandbox' per the vendor description, host compromise requires chaining a separate sandbox escape - which is why Google rated the issue Chromium severity Low even though NVD scored it 8.8 while our own assessment lands at C:L/I:L/A:L. No public exploit code or CISA KEV listing was identified at time of analysis, and the flaw is addressed by the vendor's 156.0.8078.47 stable release.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the stable-channel update described in https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, then relaunch the browser and confirm the build under chrome://version; enterprise fleets should force the update through Google Update/Chrome Browser Cloud Management rather than relying on user-initiated restarts, since Chrome only applies the new binary after a restart. Because exploitation requires the victim to load attacker-controlled HTML, interim risk reduction should focus on reducing exposure to untrusted pages (restricting browse-anywhere access for high-value users, tightening Safe Browsing/Enhanced Protection, and blocking untrusted content classes at the proxy) - these carry real usability costs and do not address the underlying memory-safety bug. Do not disable the renderer sandbox or Site Isolation (e.g. running with --no-sandbox or relaxing site-per-process) as a workaround: the sandbox is the only thing keeping this use-after-free from becoming host-level compromise, so weakening it converts a Low-severity issue into full-impact RCE. Chromium-based browsers other than Chrome should be updated to a build that has merged the corresponding upstream media fix, and detection should track the upstream issue https://issues.chromium.org/issues/559776316 for merge status until their advisories publish an exact version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free): Chrome's Media component frees an object during media handling but retains a dangling reference that attacker-supplied content from a crafted HTML page can still reach, producing memory corruption that a remote attacker can steer toward arbitrary code execution. The affected surface is the browser's media pipeline (demuxing/decoding of media presented on a page) rather than a network-facing service, so the attack path is client-side drive-by: AV:N at the CVSS layer, but effectively gated behind UI:R because the victim must navigate to or be lured onto the attacker's page. Critically, the description states execution occurs only inside the sandbox, so the primitive yields renderer-level code execution rather than host compromise, and the practical severity depends heavily on whether a sandbox-escape primitive is available to chain - the rationale behind Google's Low Chromium rating and the C:L/I:L/A:L vector in our independent assessment, which deliberately diverges from NVD's 8.8 (C:H/I:H/A:H) that appears to credit full sandbox-escape impact to this CVE alone. No CPE strings were supplied in the source data, so affected builds are identified from the EUVD version range (Chrome < 156.0.8078.47) and the vendor stable-channel advisory rather than through CPE matching, and the accompanying tags (RCE, Denial Of Service, Memory Corruption, Use After Free) reflect the memory-corruption class rather than confirmed in-the-wild activity.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page with no auth but mandatory user interaction (AV:N/AC:L/PR:N/UI:R); impacts reduced to Low because code is confined to the renderer sandbox without a chained escape.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a high-severity use-after-free in the Media component that can allow remote code execution within the browser's renderer sandbox when a user opens a crafted HTML page. Because exploitation requires user interaction and remains confined to the sandbox-host compromise would need a separate sandbox escape-the immediate organizational risk is concentrated in workforce browsing rather than direct server exposure, but the broad Chrome footprint and 8.8 CVSS score warrant coordinated patching. No public exploit code or CISA KEV listing was identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB