EUVD-2026-105465
GHSA-47c2-j8x8-pwjp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious Canvas content
-
ExecutionTrigger memory corruption in Canvas
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Chrome build (any version prior to 156.0.8078.47 on desktop/ChromeOS) and to load a crafted HTML page that exercises the Canvas rendering path - this is the UI:R user-interaction requirement and the primary limiting factor. No authentication is required (PR:N) and no special non-default browser configuration is indicated; Canvas is a standard, enabled web feature. A key impact-limiting factor is that the description scopes code execution to 'inside the sandbox' (S:U), so without a chained sandbox-escape the attacker does not gain code execution on the host OS. |
| Impact | This is a genuine priority despite the absence of exploitation telemetry. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: a remote, unauthenticated attacker triggers memory corruption (CWE-119) in Chrome's Canvas component via a crafted HTML page, requiring only that the victim load the page (UI:R). The high confidentiality/integrity/availability impacts reflect potential arbitrary code execution. Critically, the description explicitly states code execution occurs 'inside the sandbox,' so S:U (no scope change) is correct - this is NOT a confirmed full sandbox escape, which meaningfully caps real-world impact unless chained with a separate sandbox-escape bug. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; absence of these is not evidence of low risk. Signals do not conflict, but the browser-renderer memory-corruption pattern in a ubiquitous product historically attracts reliable exploit development, so defenders should treat the patch as high urgency even though active exploitation is not confirmed in the supplied data. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious Canvas content and lures a victim running a vulnerable Chrome version (prior to 156.0.8078.47) to visit it. Loading the page triggers memory corruption in the Canvas component, potentially allowing arbitrary code execution within the renderer sandbox. No public exploit was identified in the provided data, and successful full compromise of the host would additionally require a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Canvas rendering path affects desktop and ChromeOS builds prior to 156.0.8078.47, allowing a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) to open the crafted page, and the CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact within the renderer sandbox; no public exploit identified at time of analysis and no CISA KEV listing was provided. Google has released a vendor patch in version 156.0.8078.47.
RemediationAI
Upgrade to Google Chrome 156.0.8078.47 or later; on desktop use Help > About Google Chrome to trigger the update and restart the browser, and on ChromeOS use Settings > About ChromeOS. Enterprise administrators should push the fixed version through their update management tooling and verify chrome://version reports 156.0.8078.47 or later. Vendor advisories are https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html. If immediate upgrade is not possible, compensating controls are limited because Canvas is a core web feature: restrict use of the affected browser for untrusted web content (trade-off: major usability loss), keep the Chromium sandbox enabled and avoid --no-sandbox flags (trade-off: none; essential to contain renderer compromise), and isolate browsing in a separate low-privilege account or virtualized environment (trade-off: operational overhead). These do not replace patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-119 memory-buffer bounds error in Chromium's Canvas implementation, which is a standard web API used for 2D and related graphics rendering. A crafted HTML page can trigger out-of-bounds memory operations during canvas rendering, corrupting memory and potentially leading to code execution in the renderer process. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: network-delivered, low complexity, unauthenticated, but dependent on the victim interacting with the crafted page. The description scopes potential code execution to 'inside the sandbox,' so host-level compromise would require a separate sandbox escape; the Chromium severity of High and CVSS 8.8 reflect the renderer-level risk. No CPE strings were included in the provided data, but the Chrome desktop and ChromeOS stable-channel advisories identify affected Chrome builds prior to 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no auth (PR:N) but victim must load it (UI:R); code execution confined to the sandbox keeps scope unchanged (S:U) with full renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a memory corruption flaw in the Canvas rendering path that can let a crafted web page run arbitrary code inside the browser sandbox on desktop and ChromeOS systems. Because exploitation only requires a user to open a malicious page, any employee browsing the web on an unpatched device is a potential entry point, making this a broad workforce-wide exposure rather than a narrow technical concern. Leadership should care because a compromised browser session can expose sensitive data and disrupt productivity across the organization until the browser fleet is updated.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB