EUVD-2026-105568
GHSA-5vfx-qm3g-7x8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
ExploitDeliver crafted HTML/ServiceWorker content
-
ExecutionTrigger memory corruption in ServiceWorker
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to visit a crafted HTML page (UI:R / user interaction required) that exercises the ServiceWorker component - no authentication or special privileges are needed (PR:N). The primary limiting factors are: (1) the victim must actively load attacker-controlled web content, so there is no fully drive-by, zero-interaction path; and (2) resulting code execution is confined to the renderer sandbox per the vendor description, so standalone impact on the host requires an additional sandbox-escape bug. No non-default configuration is required - standard Chrome with ServiceWorker support (default) is sufficient. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted HTML page) and does not change scope. A critical mitigating signal is in the description itself: code execution is confined 'inside the sandbox,' meaning this single bug does not by itself yield a full host compromise - it would need to be chained with a separate sandbox-escape to be fully weaponized, which the CVSS C:H/I:H/A:H rating does not reflect. Google/Chromium internally rated the security severity only 'Medium,' which contrasts with the 8.8 'High' CVSS base score; this divergence reflects the sandbox containment. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation - treat it as no public exploit identified at time of analysis. Net: this is a legitimate browser memory-corruption bug worth patching on normal Chrome update cadence, but the absence of exploitation signals plus the in-sandbox limitation argue against emergency out-of-band response. Verify sandbox-escape chaining potential with vendor; the raw 8.8 overstates standalone impact. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted content that triggers the ServiceWorker memory-corruption bug when a victim running a pre-156.0.8078.47 Chrome browser visits it (UI:R). Successful exploitation corrupts memory to execute attacker-controlled code within the renderer sandbox; a full compromise would additionally require a separate sandbox-escape vulnerability. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Chrome's ServiceWorker subsystem lets a remote attacker potentially achieve arbitrary code execution inside the renderer sandbox when a victim browses a crafted HTML page, and affects Chrome builds earlier than 156.0.8078.47. Although Google's Chromium severity rating is Medium, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity flaw that requires no credentials - only that the user load attacker-controlled web content. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than a confirmed actively attacked vulnerability; Google issued a fixed build (156.0.8078.47) and the referenced Chromium issue tracker entry remained access-restricted until most users updated.
RemediationAI
Vendor-released patch: Chrome 156.0.8078.47. Update through Chrome's built-in updater (Settings > About Chrome, or the enterprise MSI/PKG/DEB/RPM packages) and verify via chrome://version that the reported version is 156.0.8078.47 or later; the same remediation applies to any Chromium-derived browser once its vendor publishes a build on an equivalent or newer Chromium milestone, and version data can be cross-checked at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://nvd.nist.gov/vuln/detail/CVE-2026-113172. Because the flaw is reachable from ordinary web content, there is no configuration switch that cleanly removes exposure - disabling ServiceWorker (e.g. via the 'DefaultJavaScriptSetting'/JavaScript blocking or site-isolation style enterprise policies) is not a supported mitigation for ServiceWorker itself, breaks offline web apps and PWAs for users, and should be considered only as a short-term emergency measure while rollout completes. Practical compensating controls, with trade-offs: keep the renderer sandbox and Site Isolation enabled so any successful exploitation is contained to the renderer rather than the host (do not disable these for performance); block or restrict untrusted web categories at the proxy/secure web gateway to reduce the chance a user reaches a crafted page (adds latency and false positives); and accelerate update enforcement via Chrome's auto-update policies so unpatched clients stop browsing (users lose the ability to defer restarts). Monitor for anomalous renderer crashes on ServiceWorker-heavy sites as an early-warning signal. Since no public exploit has been reported, prioritise this within normal Chrome patch cadence rather than emergency incident response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ServiceWorker is the Chromium API that registers an origin-scoped background script to sit between the page and the network, intercepting fetch events and backing offline caches, push messaging and background sync. This scheduling and message-passing surface is implemented in C++ on top of Blink and is exposed to untrusted web content by default in every standard Chrome profile, which makes it a recurring target for memory-safety defects. The assigned CWE-119 (improper restriction of operations within the bounds of a memory buffer) points to an out-of-bounds read or write - likely a lifetime, length or indexing error during worker registration or message dispatch - that corrupts heap state in the renderer and, with attacker-shaped data, can redirect control flow to attacker-chosen code. Consistent with the Chrome release notes, the impact described by the vendor is confined to the renderer sandbox: a single bug of this class typically yields code execution as the sandboxed renderer, and full host compromise would require chaining a separate sandbox-escape vulnerability. The CVSS vector's UI:R component reflects the need for the victim to navigate to a malicious or compromised page; PR:N and AC:L reflect that no authentication or unusual race conditions are involved, and S:U/S: unchanged.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to visit it (UI:R); scope unchanged (S:U) as code stays within the renderer sandbox, with high C/I/A on that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds before 156.0.8078.47 contain a ServiceWorker memory-corruption flaw that could allow a crafted web page to execute code within the browser's renderer sandbox, putting users who browse untrusted content at risk. Because Chrome is widely deployed and exploitation requires only user interaction, leadership should treat this as a time-bound patch-management priority, though no public exploit has been identified at time of analysis and it is not in CISA KEV.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB