EUVD-2026-105642
GHSA-qfv7-8r6x-cvf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Actor
-
ExecutionCorrupt freed object memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit or load a crafted HTML page under attacker control (CVSS UI:R), so it is not a fully passive or wormable attack. No authentication is required (PR:N). The critical limiting factor is that resulting code execution is explicitly confined to the Chrome renderer sandbox (Scope:Unchanged) - the attacker does not gain host-level code execution without separately chaining a sandbox-escape vulnerability. Affects Google Chrome desktop versions prior to 156.0.8078.47; patched builds are not exploitable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) that requires user interaction, consistent with the description of exploitation via a crafted HTML page. However, two signals temper the raw score: Google's own Chromium severity rating is only 'Medium', and the description explicitly limits code execution to 'inside the sandbox' (Scope:Unchanged), meaning a successful exploit yields renderer-level code execution that still needs a separate sandbox escape to achieve full host compromise - the 8.8 therefore reflects impact within the renderer, not full device takeover. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a standard, patch-worthy Chrome renderer memory-corruption bug affecting a ubiquitous product, warranting prompt patching, but with no current data elevating it to emergency priority beyond normal browser update cadence. The gap between the high CVSS and the vendor's Medium rating is explained by the sandbox confinement and should be noted when prioritizing. |
| Exploit ScenarioDerived | A remote attacker hosts or injects a malicious HTML page and lures a victim into visiting it (e.g., via a link, ad, or compromised site). The page triggers the use-after-free in the Actor component, corrupting memory to execute attacker-controlled code within the Chrome renderer sandbox. No public exploit code is identified at time of analysis, and full system compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A use-after-free in Google Chrome's 'Actor' component allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. The flaw affects Chrome desktop builds prior to 156.0.8078.47 and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network-reachable, low complexity, and requiring no authentication, but gated by user interaction since the victim must actively visit or load the attacker's page. Impact is explicitly bounded by Chrome's sandbox (Scope:Unchanged), so host-level compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released a fixed build.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - Vendor-released patch: 156.0.8078.47 - which is distributed through the standard Stable Channel update described in the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; the browser must be fully restarted (not merely background-updated) for the new renderer binary to take effect, and administrators should verify the installed build via chrome://version or their endpoint inventory. For managed fleets, force the version floor through the update policy so endpoints cannot linger on pre-156.0.8078.47 builds, and confirm the update has actually installed rather than only downloaded. Until the patch is deployed, compensating controls are inherently weak because the attack only needs a victim to open a page: restrict browsing to an allowlisted set of destinations and block uncategorized or newly registered domains at the proxy (trade-off: breaks long-tail browsing and generates helpdesk load), and consider disabling Chrome's Actor/automation surface through enterprise policy where your Chrome build exposes such a control (trade-off: removes a productivity feature and the exact policy name must be validated against the deployed admins template). Keep site isolation and the renderer sandbox enabled, since they limit the blast radius to the renderer even on unpatched hosts, and plan to patch promptly rather than rely on sandbox depth alone - a use-after-free of this class is a standard first stage for a two-bug chain with a sandbox escape.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, in Chrome's 'Actor' component - a feature area whose objects are created, referenced, and torn down across asynchronous lifetimes, making stale-pointer retention a realistic failure mode. When the freed object's memory is reallocated and attacker-influenced data lands in the reclaimed slot, a subsequent dereference (for example through a virtual dispatch or a callback invocation) can be steered by the attacker, converting a memory-lifetime bug into controlled code execution within the renderer process. Because the defect lives in browser-side component logic rather than in the JavaScript engine itself, exploitation is typically packaged as a crafted HTML page that manipulates the component through normal web-reachable surfaces, meaning the attacker needs no credentials or local access. The Scope:Unchanged rating in the CVSS vector is significant: any code execution gained is confined to the Chrome renderer sandbox, and crossing into the operating system requires a second, independent sandbox-escape primitive. Chromium tracked the report privately under issue 558301759 and rated it Medium on its internal severity scale, which reflects the sandbox containment rather than the raw memory-corruption potential.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim visit (AV:N, UI:R, PR:N); renderer-confined code execution keeps S:U with full C/I/A impact within the sandbox context.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a use-after-free flaw that can allow a malicious webpage to execute code inside the browser's renderer process, affecting employees across the managed desktop estate who rely on Chrome for daily web access. Exploitation requires the user to visit a crafted page and is contained by Chrome's sandbox, so host-level compromise would need an additional escape; no public exploit code or active exploitation has been identified, and a vendor fix is available. Leadership should care because unmanaged browser versions create a broad, low-effort attack surface that is best closed through rapid, verified fleet-wide updating.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB