EUVD-2026-105672
GHSA-jv44-pjpj-8797
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Compositing
-
ExecutionReclaim freed object, corrupt memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (prior to 156.0.8078.47) - reflected by UI:R in the CVSS vector. No authentication is required (PR:N) and no special Chrome configuration is needed; default installations are affected. The principal limiting factor is sandbox containment: the description states code executes 'inside the sandbox', meaning the attacker gains renderer-process execution only, and escaping to the host OS requires a separate, un-described sandbox-escape vulnerability. User interaction (visiting the page) is the other gating factor. |
| Impact | Signals are mixed and should be weighed carefully. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the typical profile of a browser drive-by. However, Google's own Chromium security team rated this only 'Medium', and the description explicitly states code executes 'inside the sandbox'. This is a meaningful conflict: the high C/I/A values reflect renderer-process compromise, but the scope is Unchanged (S:U) and the sandbox contains the attacker to the renderer - full host compromise would require chaining a separate sandbox-escape bug not described here. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit was supplied, so there is no evidence of active exploitation. Bottom line: a genuinely patch-worthy memory-corruption bug in an ubiquitous product, but the 8.8 score overstates standalone real-world impact given sandbox containment and the vendor's own Medium rating. Treat as routine-but-prompt browser patching rather than an emergency, absent new exploitation intelligence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that manipulates Chrome's Compositing component to trigger a use-after-free. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, and the freed-object reuse lets the attacker execute arbitrary code within the renderer sandbox. No public exploit code was identified in the provided data; full system compromise would additionally require a sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's compositing component enables remote code execution inside the browser sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47. The CVSS vector indicates unauthenticated network access but requires user interaction (UI:R), and the description limits impact to code execution inside the sandbox rather than host escape without a separate sandbox-escape flaw. No public exploit code was identified at time of analysis; Google has released Chrome 156.0.8078.47 as the vendor fix, and risk is tempered by sandbox containment and the need to lure a user to attacker-controlled HTML.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later using the vendor stable-channel release and restart the browser so the new build is active; verify the version at chrome://version. For managed environments, push the update through Chrome enterprise update policies or the organization's software deployment tooling, and reference the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. No vendor workaround is documented for this use-after-free, so if immediate patching is not possible, reduce exposure by restricting browsing to trusted sites, isolating or remotely rendering untrusted web content, and keeping Chrome's sandbox enabled; these controls lower the chance of a crafted page reaching the vulnerable compositing path but add latency or limit user flexibility and do not replace the patch. Do not disable the sandbox as a mitigation, because that would remove the containment layer that limits this issue's impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's compositing subsystem, which coordinates rendering layers and GPU-backed composition for web content. A use-after-free occurs when a compositing object is freed but later dereferenced, allowing an attacker who controls HTML/rendering input to influence heap state and potentially redirect execution. Because the affected code runs in the renderer/compositor path, the described impact is arbitrary code execution inside Chrome's sandbox; escaping to the host operating system would require chaining a separate sandbox-escape vulnerability. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects remote reachability and no authentication requirement, but also reflects that a user must load the crafted page. EUVD lists affected Chrome versions below 156.0.8078.47; no CPE strings were included in the supplied data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted HTML needs no auth (PR:N) but requires the victim to load the page (UI:R); renderer compromise stays in the sandbox so scope is Unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity remote-code-execution flaw in the compositing component that can be triggered when an unauthenticated attacker lures a user to a crafted web page. Because Chrome is widely deployed across the workforce, unpatched endpoints create broad organizational exposure, though the impact is limited to code execution inside the browser sandbox and requires user interaction. No public exploit identified at time of analysis, but leadership should still prioritize rapid browser fleet remediation given the product's ubiquity and the high CVSS score.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB