EUVD-2026-105504
GHSA-v475-77hh-7vc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Bindings
-
ExecutionCorrupt renderer memory layout
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build (before 156.0.8078.47) that exercises the affected Bindings code path (UI:R - the user must visit or render a crafted HTML page). No authentication or special privileges are needed on the target (PR:N), and default Chrome configurations are affected. The key LIMITING factors are: (1) mandatory user interaction of visiting/rendering the malicious page, and (2) code execution is contained within the renderer sandbox per the vendor description, so escaping to full host compromise requires an additional, separate sandbox-escape vulnerability not covered by this CVE. |
| Impact | Signals are moderately consistent but point to a priority-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) yields 8.8 (High) because an unauthenticated remote attacker needs only to lure a user to a crafted HTML page to trigger memory corruption with High confidentiality, integrity and availability impact. However, two tempering factors stand out: the code execution is explicitly scoped 'inside the sandbox' per the description, meaning full host compromise still requires a separate sandbox-escape chain, and Chromium itself rated the security severity only 'Medium' - a notable divergence from the 8.8 CVSS. No EPSS score, KEV listing, or POC indicator was provided, so exploitation probability cannot be quantified from the data. UI:R (the victim must visit a page) further limits mass, automated exploitation. Net: a genuine patch-promptly issue given Chrome's footprint, but not confirmed as actively exploited, and the sandbox containment plus Medium Chromium rating argue against treating it as a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted content that triggers the memory-corruption flaw in Chrome's Bindings when the page is rendered. A victim running a vulnerable Chrome build visits the page (UI:R), and the attacker potentially achieves arbitrary code execution confined to the renderer sandbox. No public exploit code was identified in the provided data, and real-world impact would typically require chaining with a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Bindings component before 156.0.8078.47 allows remote, unauthenticated attackers to potentially achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) and is constrained by Chrome's sandbox, so full host compromise would need a separate sandbox-escape flaw; no public exploit code was identified at time of analysis, and the vendor rates the issue Chromium severity Medium despite an 8.8 CVSS score.
RemediationAI
Update Google Chrome to 156.0.8078.47 or later; the vendor has released a patch, documented in the Chrome Releases stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Rely on Chrome's built-in updater or enterprise update policies such as Chrome Browser Cloud Management or Google Update, and verify the version after rollout. No vendor workaround is documented, so compensating controls should focus on reducing exposure: enforce rapid browser patching via MDM, restrict or isolate browsing of untrusted web content through remote browser isolation or URL filtering (trade-off: added latency and compatibility issues), and consider disabling unnecessary browser extensions or features that expand the attack surface (trade-off: reduced functionality). Because exploitation requires user interaction and remains sandbox-contained, prioritize this update for high-risk browsing populations rather than treating it as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 memory-buffer bounds error in Chrome's Bindings layer, the generated glue code that exposes C++ browser-engine objects to JavaScript and mediates DOM API calls. A crafted HTML page can drive malformed interaction through these bindings, corrupting memory in the renderer process and potentially redirecting execution flow. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-delivered attack that needs the victim to visit or render the page, no privileges, and high confidentiality, integrity, and availability impact within the renderer; the Chrome sandbox remains the key containment boundary, so escaping to the host requires a second vulnerability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to load it (UI:R); memory corruption yields high renderer-level C/I/A, scope unchanged as execution stays within the sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A memory-corruption flaw in Google Chrome's Bindings component, fixed in version 156.0.8078.47, could allow a crafted web page to corrupt memory inside the browser's renderer process, putting any employee who browses to hostile content at risk. Exploitation requires the user to open a malicious page and remains contained by Chrome's renderer sandbox, so the realistic outcome is a compromised or crashed browser tab rather than a fully taken-over endpoint. Leadership should care because Chrome is deployed across essentially the entire workforce, meaning the exposed population is the full user base - though no public exploit code has been identified at time of analysis and the vendor itself rates the issue Medium severity despite the 8.8 CVSS score.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB