EUVD-2026-105693
GHSA-4g38-732w-3p8r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in WebProtect
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled HTML content in a vulnerable Chrome build prior to 156.0.8078.47 (UI:R / user interaction), targeting the WebProtect component. The decisive LIMITING factor is that code execution is confined to the renderer sandbox: without a separately chained sandbox-escape vulnerability, the attacker cannot reach the host OS or data outside the browser's sandboxed process. No authentication or special server-side configuration is needed (PR:N), but the user-interaction requirement means purely passive, no-click mass exploitation is not possible. |
| Impact | Signals conflict and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw requiring only that a victim open a crafted HTML page - a classic drive-by browser profile. However, the description explicitly states code execution occurs INSIDE the sandbox (no sandbox escape), and Google assigned a Chromium security severity of Low. This is a meaningful conflict: the 8.8 score does not reflect the sandbox containment, so real-world impact is materially lower than the number suggests unless chained with a separate sandbox-escape bug. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit (POC) is indicated - so there is no evidence of active or imminent exploitation. Net: this is a patch-on-normal-cycle browser UAF, not an emergency. Priority is elevated only by Chrome's ubiquity and the ease of delivery, not by confirmed exploitation or full-system impact. Treat the 8.8 as an upper bound; the operative severity is closer to Google's Low rating given the sandbox constraint. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page (e.g., via a compromised site, ad network, or phishing link) that triggers the use-after-free in Chrome's WebProtect component when rendered. A victim running a vulnerable Chrome version simply visits the page, and the attacker gains arbitrary code execution confined within the renderer sandbox. No public exploit code has been identified at time of analysis, and the sandbox limits impact absent a separate escape primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's WebProtect component affects builds prior to 156.0.8078.47 and lets an unauthenticated remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The impact is confined to the sandboxed browser process unless a separate sandbox-escape flaw is chained, and user interaction is required. No public exploit identified at time of analysis, and Google has released a fixed build.
RemediationAI
Google has released the vendor patch in Chrome 156.0.8078.47; update to that version or later via Chrome's built-in update mechanism (chrome://settings/help or Help > About Google Chrome) or through enterprise/package management, then restart all browser processes and verify the version. See the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue at https://issues.chromium.org/issues/500474551. If immediate upgrade is not possible, limit exposure by preventing users from opening untrusted HTML in Chrome and enforcing browser isolation for risky content; the renderer sandbox reduces host impact but does not prevent in-sandbox code execution, so this is only a compensating control, not a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 use-after-free in Chrome's WebProtect component. A use-after-free occurs when an object is freed but a stale pointer remains referenced; a crafted HTML page can cause the renderer to reuse that freed memory, corrupting control data and enabling arbitrary code execution in the renderer process. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms network reachability, no privileges, and mandatory user interaction, with scope unchanged. Chromium's Low severity rating and the independent assessment both emphasize that the code execution is sandbox-confined: without a chained sandbox escape, the attacker cannot reach the host OS or data outside the browser's sandboxed process. The supplied data contains no CPE strings; version coverage comes from EUVD.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page, low complexity, no auth, but requires user to open the page (UI:R); scope unchanged and impacts high only within the sandboxed renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome builds before 156.0.8078.47 carry a high-severity flaw in the WebProtect component that can let a crafted web page run code inside the browser's renderer sandbox, with containment limiting damage unless chained with a separate sandbox escape. The issue requires user interaction and no public exploit has been identified at time of analysis, but unpatched browsers across the workforce still represent avoidable risk. Leadership should care because browser compromise can expose session data and productivity, and a vendor fix is already available for rapid remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB