EUVD-2026-105543
GHSA-7cx5-44c8-33hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Extensions
-
ExecutionExecute arbitrary code in sandbox
-
Impact(chain separate escape for host impact)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to visit or be redirected to an attacker-controlled crafted HTML page while running Google Chrome prior to 156.0.8078.47 (UI:R user interaction is mandatory - this is not a zero-click flaw). Resulting code execution is confined to the browser sandbox per the vendor description, so host-level compromise requires chaining with a separate sandbox-escape vulnerability. No authentication is required (PR:N), and the flaw is reachable against default configurations, but the user-interaction requirement and sandbox containment are the primary limiting factors. |
| Impact | Signals are moderately consistent but point to a lower real-world priority than the 8.8 CVSS implies. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a remote, low-complexity, unauthenticated flaw requiring user interaction (visiting a crafted HTML page). Critically, the description states code executes 'inside the sandbox' and Chromium rated the issue only Medium severity - this is a renderer/extension-context memory corruption, NOT a confirmed sandbox escape, so actual impact is contained unless chained with a separate sandbox-escape bug. This conflict between the high CVSS numeric score and the vendor's Medium rating should be noted: the CVSS C:H/I:H/A:H reflects worst-case renderer compromise, while the sandbox boundary materially limits consequences. No EPSS score, KEV listing, or POC was provided; exploitation status is therefore unconfirmed. Chrome bugs reported by Google's internal team and patched before public disclosure typically see exploitation only after patch-diffing, if at all. Net: patch promptly due to ubiquity and the UI:R-only barrier, but this is not an emergency-tier KEV-class threat on current evidence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption flaw in Chrome's Extensions component when a victim with a vulnerable Chrome build visits it. Successful exploitation yields arbitrary code execution confined to the browser sandbox, which an attacker would typically need to pair with a separate sandbox-escape to affect the host. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page execute arbitrary code inside the browser sandbox. The flaw is unauthenticated (PR:N) and reaches default configurations, but exploitation is not zero-click - user interaction (UI:R) is mandatory, and by Google's own description the resulting code execution is contained within the renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape bug. Google rates the issue as Chromium security severity Medium despite the 8.8 CVSS, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - this is a vendor-released patch, announced in the stable channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html - and verify the build via chrome://version, since Chrome's background updater can lag on managed or long-running endpoints. For fleets, push the version through your patch-management or Chrome Enterprise policies and confirm compliance rather than relying on auto-update. Chrome typically restricts the underlying Chromium bug until most users have updated, so the absence of public exploit details now is not a durable assurance. As an interim compensating control, disable or allowlist extensions via ExtensionSettings/ExtensionInstallBlocklist policy, which removes the primary attack surface at the cost of breaking legitimate extension workflows, and enable site isolation and renderer sandbox enforcement (--no-sandbox must never be used) so that any successful memory corruption stays confined to a low-privilege process. Network-level blocking of untrusted HTML is not a realistic mitigation for a general-purpose browser; prioritise version remediation instead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a memory-safety defect classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), occurring in Chrome's Extensions subsystem - the component that loads, parses, and manages extension manifests and resources. Out-of-bounds reads or writes in native extension-handling code can be turned into controlled memory corruption by supplying malformed content through a rendered page, which is why the attack vector is network-based (AV:N) with low attack complexity (AC:L). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects high confidentiality, integrity, and availability impact within the same security authority scope; because the scope is Unchanged, the assessed damage is bounded by Chrome's multi-process architecture. The sandbox is the critical mitigating layer: a successful exploit yields code execution at the privilege of the renderer/extension process rather than the operating system user, so the practical risk depends heavily on whether an additional sandbox-escape primitive is available. EUVD and the vendor advisory both pin the fixed build as 156.0.8078.47, and the issue is tracked publicly as Chromium bug 513184498.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs user interaction (UI:R), no auth (PR:N), low complexity; scope unchanged (S:U) as code stays in-sandbox with no confirmed escape.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 156.0.8078.47 contain a memory-corruption flaw that could allow an attacker to execute code inside the browser sandbox when an employee visits a crafted HTML page. Because Chrome is widely deployed across the workforce, unpatched browsers create organizational exposure to session or data compromise within the browser context, although exploitation requires user interaction and no public exploit identified at time of analysis. Leadership should prioritize rapid browser remediation to reduce risk across default configurations and internet-facing users.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB