EUVD-2026-105456
GHSA-34w4-g7pq-pjfg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger DisplayLocking memory corruption
-
ExecutionExecute arbitrary code in renderer
-
ImpactOperate inside browser sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content (UI:R) in an unpatched Chrome build prior to 156.0.8078.47 - e.g. visiting a malicious site, opening a crafted HTML page, or rendering malicious embedded/ad content - and the DisplayLocking code path must be exercised. No authentication or special privileges are needed (PR:N). The key limiting factors are: mandatory user interaction (no drive-by without the victim opening content), and that successful code execution is confined to the renderer sandbox (S:U), so a full system compromise additionally requires a separate sandbox-escape vulnerability. |
| Impact | This is a legitimate high-priority patching item for any environment running Google Chrome. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated memory-corruption flaw (CWE-119) that yields high confidentiality, integrity, and availability impact - but critically, scope is Unchanged (S:U) and the description explicitly states code execution occurs 'inside the sandbox,' meaning this is renderer-level RCE and not a full sandbox escape by itself. UI:R is the main mitigating signal: a victim must open attacker-controlled content. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis; the only exploitation framing (RCE) comes from the metadata tag, not from confirmed in-the-wild activity. Given Chrome's ubiquity, the attractiveness of browser RCE to exploit chains, and that a vendor patch already exists, treat this as a standard-urgency 'patch promptly' item rather than an emergency, absent any active-exploitation signal. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects crafted HTML/ad content into a page a victim visits) that triggers the DisplayLocking memory-corruption bug. When the victim opens the page in an unpatched Chrome build, the attacker gains arbitrary code execution within the renderer sandbox, which is typically then paired with a separate sandbox-escape bug to achieve full compromise. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Blink DisplayLocking component of Google Chrome allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), and because the sandbox is unchanged (S:U), code execution is confined to the renderer - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, but the flaw is rated High by Chromium and the vendor has released a fixed build, making it a high-priority patch item for any environment running Chrome.
RemediationAI
Vendor-released patch: 156.0.8078.47 - upgrade Google Chrome to 156.0.8078.47 or later immediately via the built-in updater (chrome://settings/help) or your managed software-deployment channel, and relaunch the browser so the new binary is actually loaded; on ChromeOS apply the corresponding Stable Channel update from http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html, and see the desktop advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html for release specifics. Because DisplayLocking is a core rendering-engine capability with no supported policy flag to disable it, there is no clean feature-toggle workaround; the practical compensating controls while patching is in flight are to force-enable automatic updates and browser relaunch (trade-off: forced restarts disrupt user sessions), keep the renderer sandbox and site isolation enabled and treat the issue as renderer-confined rather than a full host compromise so prioritisation reflects the need for a chained sandbox escape (trade-off: not a mitigation for the memory corruption itself), and reduce exposure to untrusted HTML - for example by restricting browsing to approved sites or a hardened profile for high-risk users (trade-off: reduced usability and incomplete coverage of embedded/ad content). Prioritise patching endpoints where users routinely open links and advertisements from untrusted sources, since user interaction is the only prerequisite.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) describes an out-of-bounds read/write class defect in DisplayLocking, the Blink rendering-engine feature that lets content be locked for display (used by mechanisms such as content-visibility) so that layout, style, and paint work for a subtree can be deferred and committed atomically. Because DisplayLocking manipulates lifecycle state across the DOM, style, layout, and paint stages, a malformed HTML document that drives the locking/unlocking state machine into an inconsistent condition can corrupt engine-managed memory. The affected surface is the HTML renderer, so the corrupting primitive is reachable by any page the user loads - including embedded advertising or third-party content - without credentials. The attacker's payoff is arbitrary code execution at the privilege level of the renderer process, which in Chrome runs inside the site-isolation and OS-level sandbox; escaping that boundary to reach the host requires an additional, independent vulnerability. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network reachability, low attack complexity once content is rendered, no privileges, forced user interaction, and high confidentiality/integrity/availability impact limited to the renderer scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no auth (AV:N/PR:N) but requires the victim to open it (UI:R); execution stays in the renderer sandbox so scope is Unchanged with full renderer-context C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds before 156.0.8078.47 contain a high-severity Blink DisplayLocking memory-corruption flaw that could let a crafted web page, after user interaction, execute code within the browser renderer. Exposure is broad because Chrome is widely deployed, but impact is constrained by the unchanged renderer sandbox and no public exploit identified at time of analysis; a vendor fix is available. Leadership should care because unpatched browsers on managed and unmanaged endpoints create avoidable risk and require rapid update verification.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB