EUVD-2026-105687
GHSA-rxhp-hg75-v39h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in SignIn component
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively browse to attacker-controlled content - the crafted HTML page - so user interaction (UI:R) is a firm limiting factor; it is not a wormable server-side flaw. The vulnerability resides specifically in Chrome's SignIn component, and code execution is constrained to within the renderer sandbox, meaning this bug alone cannot compromise the host without an additional sandbox-escape vulnerability. No authentication is required (PR:N), and default Chrome configurations prior to 156.0.8078.47 are affected; the practical limiter is the sandbox boundary plus the need to drive a user to a malicious page. |
| Impact | Signals are genuinely conflicting and must be reconciled before prioritization. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) frames this as high-severity remote, low-complexity, unauthenticated-but-user-interaction code execution, yet Google/Chromium itself rated the security severity as Low. The reconciling factor is in the description: code execution is achieved 'inside the sandbox,' meaning this bug alone yields only renderer-process compromise and would require a separate sandbox-escape chain to achieve full system compromise - which is why Chromium's internal severity diverges downward from the CVSS score. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit is referenced, so there is no public exploit identified at time of analysis. Net assessment: this is a patch-promptly item rather than a drop-everything emergency - the raw 8.8 overstates standalone impact because of the sandbox boundary, while the ubiquity of Chrome keeps it from being dismissible. Note the EPSS score is entirely absent from the input, so exploitation-probability modeling could not be incorporated; verify against a live EPSS feed before final triage. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that triggers a use-after-free in Chrome's SignIn component when a victim browses to it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape bug for full host compromise. No public proof-of-concept or exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's SignIn component before version 156.0.8078.47 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. Exploitation requires user interaction (UI:R) and remains bounded by Chrome's sandbox, so host compromise would require a separate sandbox-escape vulnerability; Google rates the Chromium security severity as Low despite a CVSS score of 8.8. No public exploit or CISA KEV listing was identified at time of analysis, and a vendor patch is available.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later; vendor-released patch: 156.0.8078.47. Apply the stable channel update described in Google's advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and verify the browser version after restart. Until patched, reduce exposure by enforcing browser update policies, restricting users from visiting untrusted HTML content, and maintaining Chrome sandbox protections; disabling the SignIn component is not a documented workaround, and disabling the sandbox would increase risk. No public exploit was identified at time of analysis, but patching remains warranted given the code-execution potential within the renderer sandbox.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a use-after-free (CWE-416) in Chrome's SignIn implementation, where a freed object can be reused during processing of crafted HTML, leading to memory corruption and potential arbitrary code execution within the renderer process. Chrome's multi-process architecture confines renderer code execution to the sandbox, meaning this bug alone does not compromise the host operating system; an attacker would need an additional sandbox-escape primitive. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network reachability, no privileges required, and mandatory user interaction, while the Chromium severity rating is Low. The affected component is specifically SignIn, not the broader browser process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery gives AV:N/AC:L/PR:N, visiting the page is UI:R, and in-sandbox arbitrary code execution yields high C/I/A with unchanged scope.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome's SignIn component has a high-severity memory-safety flaw that could allow code execution inside a user's browser renderer after visiting a crafted HTML page, with impact constrained by Chrome's sandbox so full host compromise would require an additional vulnerability. Because Chrome is widely deployed and exploitation requires user interaction, leadership should prioritize rapid update assurance, while noting that no public exploit was identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB