EUVD-2026-105646
GHSA-g6qh-rmxp-hmqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
ExploitServe crafted HTML payload
-
ExecutionTrigger out-of-bounds read in Actor
-
ImpactLeak adjacent sandbox memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to navigate a vulnerable Chrome build (any version prior to 156.0.8078.47, default configuration - no special feature flag needed) to an attacker-controlled page serving crafted HTML; the flaw is reached through the 'Actor' component. The key limiting factor is required user interaction (UI:R): the victim must actively visit or be lured to the malicious page. Impact is further bounded to reading memory within the renderer sandbox, so no code execution, no cross-origin/cross-process read, and no integrity or availability effect result. Chrome's automatic update mechanism also shortens the realistic exposure window. |
| Impact | This is a moderate-priority issue that does not rise to emergency patching urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw, but it requires user interaction (UI:R) and yields only an information-disclosure primitive (C:H / I:N / A:N) - no code execution and no integrity or availability impact. Critically, the disclosure is scoped 'inside the sandbox' per the description, which materially limits the value of the leaked data versus a full-process or cross-origin read; this tension between the CVSS C:H rating and the sandbox-constrained description is worth noting. Exploitation signals are weak: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. Google/Chromium rated this Medium severity, consistent with the limited impact. Net: real but low-urgency - patch on the normal Chrome auto-update cadence rather than treating it as an actively-exploited priority. No conflicting signals across sources; all point to a low likelihood of widespread exploitation. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted HTML that triggers the out-of-bounds read in the Actor component when a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits it. The flaw lets the attacker read adjacent memory within the renderer sandbox, potentially leaking sensitive in-process data that could aid further attacks. No public exploit identified at time of analysis, and successful exploitation depends on the victim navigating to the attacker-controlled page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Out-of-bounds read in Google Chrome's Actor component (all desktop builds prior to 156.0.8078.47) allows a remote attacker to read memory inside the renderer sandbox when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the victim must navigate to attacker-controlled content - and the impact is bounded to information disclosure within the sandbox, with no code execution, no cross-origin or cross-process read, and no integrity or availability effect; our assessment scores confidentiality as Low (CVSS 3.1 base ~4.3-5.4 range, NVD lists 6.5 with C:H) rather than the higher NVD value. Google rated the issue Medium (Chromium security severity), EPSS is low at 0.22% (12th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate-priority fix rather than an emergency patch.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, available through the stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; confirm the installed build via chrome://settings/help and force a relaunch if the update has downloaded but not applied, since Chrome's automatic updater shortens but does not eliminate the exposure window and users who defer relaunch remain vulnerable. For managed fleets, push 156.0.8078.47 through your enterprise update mechanism (Google Update policy, Chrome Browser Cloud Management, or your software deployment tool) and verify compliance by version inventory rather than by patch ticket closure. No practical configuration workaround fully removes the flaw, because the Actor component is reachable in a default profile without a feature flag; the available compensating controls each carry trade-offs - restricting browsing to an allowlist of trusted sites reduces exposure to crafted pages but breaks general web use, and enabling strict site isolation or disabling JavaScript for untrusted destinations lowers the chance of reaching the vulnerable code path at the cost of functionality and performance. Because the primitive is confined to a sandboxed renderer and yields only low-value information disclosure, prioritise this patch behind actively exploited issues, but do not defer it indefinitely on internet-facing or high-value browsing endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-125 out-of-bounds read, meaning a length or index calculation in the Actor component fails to bound a buffer access, causing the browser to read past the end of an allocated region. Chrome's multi-process architecture places parsing and page-driven logic inside a renderer that is confined by the sandbox, so the primitive only yields bytes already reachable within that renderer's address space - it does not cross origin, process, or sandbox boundaries on its own, which is why the assessed confidentiality impact is Low rather than High. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U confirms the attack is network-delivered and needs no privileges, but is gated on convincing a user to open a malicious page; the Actor component is reachable in a default Chrome configuration without any feature flag, which keeps the attack complexity Low. Memory disclosure of this kind is typically useful as a stepping stone in a chained exploit (defeating ASLR or leaking pointers), so its standalone severity is limited but it retains value to an attacker who already has another bug in the renderer. The EPSS score of 0.22% (12th percentile) reflects the required interaction and the narrow, sandbox-contained read primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page with no auth (AV:N/PR:N) but requires a visit (UI:R); disclosure is confined to sandbox memory, so C:L rather than C:H, with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB