EUVD-2026-105730
GHSA-r57p-9x2h-7563
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure user with DevTools open
-
ExploitTrigger use-after-free in DevTools
-
ExecutionCorrupt memory and escape sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page while Google Chrome's DevTools (Developer Tools) are engaged, since the use-after-free resides specifically in the DevTools component - this is the exact precondition implied by Chromium's 'Low' severity rating and the UI:R metric. The attack is remote and needs no authentication (PR:N), but it is limited by requiring active user interaction and the atypical, non-default state of having DevTools open and inspecting attacker-influenced content; it does not fire against a default browsing session without DevTools involvement. Affected builds are Chrome prior to 156.0.8078.47 on desktop. |
| Impact | Signals conflict sharply and must be weighed carefully. NVD assigns CVSS 9.6 (Critical) on vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, reflecting a scope-changing sandbox escape with full CIA impact, yet Google/Chromium explicitly rate this issue 'Low' severity. That gap is the single most important fact here: Chromium's 'Low' rating for a DevTools use-after-free almost always signals that exploitation requires the victim to have the Developer Tools panel open and to interact with attacker-influenced content - a non-default, atypical end-user condition - which the raw CVSS AC:L/UI:R metrics understate. EPSS is not provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: despite the 9.6 headline, real-world priority is moderate rather than emergency - this is best treated as a 'high-CVSS-but-lower-real-risk' case driven by the DevTools precondition, patched via the normal Chrome auto-update channel. Patch promptly through standard Chrome update cadence, but it does not warrant out-of-band emergency response absent new exploitation evidence. Verify the severity discrepancy against the Chromium advisory before escalating. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a developer or power user who has Chrome DevTools open to load or inspect it, triggering a use-after-free in DevTools that corrupts memory and potentially executes code outside the renderer sandbox. Because the flaw lives in DevTools, exploitation realistically depends on the victim having the tools panel engaged, which is why Chromium rates it Low despite the network vector. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's DevTools component, affecting desktop builds prior to 156.0.8078.47, can potentially allow a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to load a crafted HTML page while an active DevTools session is engaged, so the attack is remote and unauthenticated but gated by user interaction and a non-default browser state - which is why Chromium assigned it a Low security severity while the raw vector scores 9.6 and our independent assessment lowers it to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later on all desktop endpoints, and confirm the version via chrome://version after the update; the release notes are at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the underlying engineering record at https://issues.chromium.org/issues/553259748. Given that exploitation depends on an engaged DevTools session, the most effective interim control is procedural: prohibit opening DevTools against untrusted or attacker-supplied pages, and treat debugging of untrusted content on production endpoints as a restricted activity - the trade-off is reduced troubleshooting capability for support and QA staff. Where DevTools use must be centrally governed, enforce it through enterprise policy rather than ad hoc guidance, and disable remote debugging interfaces (the --remote-debugging-port/--remote-debugging-pipe switches) on managed fleets, accepting that this breaks local automation and headless testing workflows. Browser isolation or forcing untrusted HTML into a disposable virtualized session also removes the precondition, at the cost of latency and some site compatibility. None of these compensating controls addresses the underlying memory-safety defect, so patching to 156.0.8078.47 remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free, a memory-corruption class in which an object is freed while a dangling reference to it remains reachable, letting an attacker reallocate the freed memory with controlled contents and redirect execution. Here the dangling reference lives specifically in Chrome's DevTools (Developer Tools) subsystem - the inspector/frontend machinery that binds page content to the debugging UI - rather than in the normal rendering path, which is why the bug does not trigger in an ordinary browsing session. Because the CVSS vector carries S:C (scope change) alongside C:H/I:H/A:H, the assessed impact spans a sandbox boundary: compromise originating in the DevTools context can yield code execution at higher privilege than the vulnerable component itself. The vector also carries UI:R and PR:N, so the attacker needs no credentials but must induce the victim to load crafted HTML while DevTools is inspecting attacker-influenced content; our assessment fixes AC:H to reflect that unusual precondition, in contrast to the vendor-agnostic 9.6 score derived from an AC:L vector. Affected software is Chrome on desktop before 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
DevTools must be open and interacting with crafted content, so AC:H and UI:R; the sandbox escape yields S:C with full code-execution impact (C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a use-after-free in DevTools that could let a crafted web page escape the browser sandbox and execute code on affected endpoints. The risk is concentrated among users who keep DevTools sessions open, such as developers and IT staff, and exploitation requires user interaction plus a non-default browser state; no public exploit has been identified. Leadership should prioritize patching developer and administrative fleets because a sandbox escape on those systems could expose source code, credentials, and internal tooling.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB