EUVD-2026-105768
GHSA-6h4w-qq47-7489
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
ExploitTrigger DevTools memory corruption
-
ExecutionCorrupt memory via buffer overflow
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-crafted HTML content in a vulnerable Google Chrome build (prior to 156.0.8078.47) on the desktop, and the flaw resides in DevTools, so the relevant developer-tooling code path must be reachable. Resulting code execution is constrained WITHIN the Chrome sandbox - this is not a demonstrated sandbox escape or host compromise, which is the key limiting factor (and why Chromium rated it Low despite CVSS 8.8). Required user interaction (UI:R - visiting/opening the page) further limits automated, large-scale exploitation; no authentication is required per PR:N. |
| Impact | Signals conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields 8.8 (High), implying remote, low-complexity, unauthenticated code execution requiring only that a victim open a crafted HTML page. However, the Chromium team explicitly rated this 'Low' severity, and the description states code executes 'inside the sandbox' - meaning this is renderer/DevTools memory corruption confined by Chrome's sandbox, NOT a full host compromise, so real-world impact is materially lower than the 8.8 suggests. No EPSS score was provided, so exploitation probability cannot be quantified. Not present in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net: patch promptly as part of routine Chrome updates, but this is a lower practical priority than the 8.8 implies - the CVSS High vs. Chromium Low divergence reflects sandbox containment and absence of a demonstrated sandbox escape. Note the DevTools attack surface typically requires the victim to have DevTools engaged, which further narrows realistic exploitation - verify exact trigger conditions with the vendor. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a Chrome user (on a version prior to 156.0.8078.47) to open it, triggering memory corruption in DevTools and achieving arbitrary code execution confined to the renderer sandbox. Given AV:N/AC:L but UI:R, success hinges on the user visiting the malicious content. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome renderer sandbox by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). The required user interaction and the fact that execution is confined within the sandbox - no sandbox escape or host compromise was demonstrated - are the key limiting factors, which is why Chromium assigned this a security severity of Low despite the high base score. No public exploit code or confirmed active exploitation was identified in the available intelligence, and EPSS data was not provided, so real-world risk should be treated as contextual rather than demonstrated; signals conflict and must be weighed carefully, since the high CVSS and RCE tag coexist with a Low vendor severity and sandbox confinement. Fixed builds are available from the vendor in Chrome 156.0.8078.47 and later.
RemediationAI
Vendor-released patch: upgrade Google Chrome desktop to 156.0.8078.47 or later as described in the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; confirm the installed version via chrome://version and rely on the browser's auto-update or an enterprise update policy (e.g. Chrome Browser Cloud Management or your software deployment tooling) to push the fixed build. There is no documented configuration flag that removes the DevTools code path without side effects, so patching is the primary control; if immediate deployment is impossible, reduce exposure by blocking developer-tools availability through the DeveloperToolsAvailability enterprise policy (set to disable DevTools for managed users - trade-off: developers lose built-in debugging and inspection), keep site isolation and the renderer sandbox enabled and do not disable them as a workaround, and enforce Safe Browsing plus network-level blocking of untrusted or newly registered domains to lower the chance of a victim reaching crafted HTML. Chromium-based browsers and embedded Chromium runtimes should be updated once their maintainers ship the corresponding upstream fix. Monitor the referenced Chromium issue for any change in exploitation status, as no public exploit code or confirmed active exploitation was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer affecting the DevTools subsystem that ships with the Chrome desktop browser. DevTools is the developer-facing inspection and debugging front end, implemented largely in web-facing code (HTML/JavaScript plus privileged bindings) that is reachable from ordinary browsing sessions when developer tooling is invoked, so memory-safety bugs there can be triggered by crafted HTML content rather than requiring a local debugging session. Successful corruption of heap or buffer state within the renderer process permits an attacker to redirect control flow (C/H/I/H under the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U vector), but per the authoritative assessment the resulting code execution remains constrained within the Chrome sandbox - this is not a demonstrated sandbox escape and does not by itself yield host compromise. The attack requires a user to open the malicious page (UI:R) and no privileges (PR:N), and the affected platform scope is Chrome desktop builds earlier than 156.0.8078.47 as recorded in the EUVD affected-version data. The CVSS environment remains unchanged (S:U) because the vulnerable component's authority is not exceeded in the assessed scenario.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N, victim must open the page so UI:R, and impact stays in the sandboxed component so S:U with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 carry a memory-corruption flaw in the DevTools component that could let an attacker run code inside the browser's renderer sandbox if a user opens a malicious web page. Because the vendor rates this Low severity and the impact is confined to the sandbox with no demonstrated host compromise, the practical organizational exposure is limited, but Chrome is deployed broadly across the workforce so an unpatched browser fleet remains a standing gap. Leadership should care mainly because of browser ubiquity and the low cost of closing the gap through normal patch management, not because of any evidence of active targeting.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB