EUVD-2026-105420
GHSA-gm4h-f65v-h23q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
DeliveryServe crafted HTML to Chrome
-
ExploitTrigger use-after-free in Network component
-
ExecutionReclaim freed memory for control
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build (prior to 156.0.8078.47) on Windows - the CVSS UI:R and the description's 'via a crafted HTML page' confirm user interaction (visiting/rendering a page) is mandatory; there is no drive-by-without-interaction path and no server-side or click-free trigger. No authentication or special privileges are needed (PR:N). The key LIMITING factor is sandbox containment: the description states code executes 'inside the sandbox,' so standalone exploitation does NOT yield host-level compromise and would need to be chained with a separate sandbox-escape vulnerability for full system control. Platform is restricted to Windows per the advisory. |
| Impact | This is a genuine high-priority patch item, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates remote, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page - a trivially achievable condition for a browser. Google rates the Chromium severity as High and a vendor patch is available. However, several real-world-risk dampeners apply: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC or exploit code is referenced, so there is no evidence of active exploitation at time of analysis. Critically, the description states code executes 'inside the sandbox,' meaning this is a renderer-level compromise that, on its own, does NOT escape Chrome's sandbox - a full system takeover would require chaining with a separate sandbox-escape bug. The provided CVSS 8.8 does not model that sandbox containment (S:U with full C/I/A), so the raw score likely overstates standalone host impact. Net: treat as a routine-but-prompt browser update; signals are consistent (network vector matches a web-delivered UAF) with no conflicts, but exploitation is theoretical rather than observed. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/script that triggers the use-after-free in Chrome's Network component. When a victim running a vulnerable Chrome version (prior to 156.0.8078.47) on Windows visits the page, the freed-then-reused memory is manipulated to achieve arbitrary code execution within the renderer sandbox. No public exploit code is identified at time of analysis, and successful code execution remains confined to the sandbox absent an additional escape primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Chrome's Network component on Windows lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the browser sandbox. All Windows Chrome builds prior to 156.0.8078.47 are affected; exploiting it requires user interaction (rendering attacker-controlled content) but no credentials, and the resulting code execution is contained by the sandbox, so full host compromise needs chaining with a separate sandbox escape. Google rates it High severity and a fixed build is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Google Chrome on Windows to 156.0.8078.47 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; because Android, macOS, and Linux builds are not listed as affected, prioritize Windows endpoints first. Where immediate upgrade is not possible, interim controls are: enforce that only the current Chrome stable build is permitted on managed Windows hosts and block launch of older versions (trade-off: users on legacy extensions or pinned builds lose them), disable automatic restoration of stale browser sessions so crafted pages are not reloaded on restart, and reduce exposure by keeping the Windows browser running with the sandbox enabled and untrusted web content confined to Chrome rather than embedded WebView/CEF shells that may lag patched Chromium (trade-off: embedded apps must be updated or access-restricted separately). Monitor Chromium issue 557075191 and the Chrome Releases blog for any follow-up sandbox-escape reports, since this bug alone yields only in-sandbox code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, a memory-safety class in which an object in the Network component (Chrome's networking stack handling resource loads, requests, and their lifetimes) is freed while a reference to it remains, allowing the attacker to reallocate the freed memory with crafted content from a malicious page and achieve controlled memory corruption. Because the flaw lives in the browser process's network code path reached through normal page loading, a rendered HTML page is a sufficient trigger vector, matching the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Critically, the issued severity is scoped to code execution inside the browser sandbox on Windows only; impact on the host depends on a separate sandbox-escape primitive, and nothing in the advisory indicates renderer-to-browser or OS-level privilege escalation on its own.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Web-delivered UAF needs no auth (PR:N) but requires a victim to load a page (UI:R); sandbox-confined RCE keeps scope unchanged (S:U) with high renderer-process C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Windows is affected by a high-severity memory corruption flaw (CVE-2026-113119, CVSS 8.8) that could let an attacker run code inside the browser sandbox if a user simply visits a malicious or compromised web page; the issue affects every Windows Chrome build below 156.0.8078.47. Because Chrome is deployed broadly across the organization and exploitation hinges on routine web browsing rather than credentials, the exposure footprint is essentially the entire Windows user population, though the sandbox limits a single successful attack to browser-level code execution rather than full host takeover. Google has shipped a fixed build and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a patch-cadence and exposure-reduction issue rather than an emergency incident.
Apply vendor patch (Chrome 156.0.8078.47 or later on Windows).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB