EUVD-2026-105479
GHSA-x3m4-7375-mghj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Extensions
-
ExecutionReuse freed object for control
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running a vulnerable Google Chrome build (desktop, prior to 156.0.8078.47) to actively open or be navigated to an attacker-controlled crafted HTML page that exercises the Extensions component - matching the CVSS UI:R requirement. No authentication is needed (PR:N), and default Chrome configurations are affected since the Extensions subsystem is part of the standard browser. The principal LIMITING factors are: (1) mandatory user interaction (the victim must load the malicious page), and (2) code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so a separate sandbox-escape vulnerability is required to compromise the host operating system. |
| Impact | This is a genuine high-priority patch item but one notch below the worst-case scenario. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution that requires only that a victim open a crafted HTML page - a trivially-met condition for a web browser. The critical mitigating signal is in the description itself: code execution is confined 'inside the sandbox' with CVSS scope Unchanged (S:U), meaning this is a renderer-process compromise with NO confirmed sandbox escape, so an attacker still needs a separate escape bug for full host takeover. Chromium's own rating is only 'Medium,' which contrasts with the 8.8 NVD score and reflects this sandbox containment. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation-probability and in-the-wild signals are absent - the SSVC-style read is 'exploitation: none observed, automatable: not established, technical impact: total within the sandboxed renderer.' Net: patch promptly because Chrome is everywhere and UAF bugs are weaponizable, but there is no evidence this is being actively exploited, and the sandbox boundary materially lowers real-world severity versus a full-chain RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing a crafted HTML payload that triggers the use-after-free in Chrome's Extensions component, then lures a victim to visit it (malvertising, phishing link, or watering-hole). When the page loads, the freed object is reused to achieve arbitrary code execution within the sandboxed renderer process. No public exploit code was identified at time of analysis, and the attacker would need an additional sandbox-escape vulnerability to reach the underlying OS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Extensions component allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim opens or is navigated to a crafted HTML page, affecting desktop builds prior to 156.0.8078.47. Google rates the flaw Medium at the Chromium severity level, while the 8.8 CVSS reflects high confidentiality and integrity impact confined to the sandboxed renderer; exploitation requires user interaction (UI:R), and full host compromise needs a separate sandbox escape. No public exploit code was identified at time of analysis, and a vendor patch shipped in the 156.0.8078.47 stable channel update published on the Chrome Releases blog.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - the vendor-released patch - using the built-in updater (chrome://settings/help), your OS package manager, or enterprise deployment tooling, and verify the reported version across all desktop fleets; the release details are at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Where immediate upgrading is not possible, reduce exposure by hardening extension usage with enterprise policy: apply ExtensionAllowlist/ExtensionInstallBlocklist to permit only vetted extensions and ExtensionInstallForceList to prevent user-initiated installs (trade-off: blocks legitimate unapproved extensions and may disrupt workflows), disable or remove extensions not strictly required (trade-off: loss of functionality), and restrict browsing to trusted sites or filter untrusted HTML content at the proxy/secure web gateway (trade-off: false positives and reduced user productivity). Note that these controls only lower the probability that the Extensions attack surface is reachable and do not remove the memory-corruption flaw itself; site isolation and the renderer sandbox remain the primary containment, and because code execution is sandbox-confined, prioritizing the update on machines that also hold sensitive credentials or admin rights is warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (use-after-free) in Chrome's Extensions subsystem, the component that implements the browser's extension platform (manifest parsing, extension API bindings, and the messaging plumbing between extension contexts and renderers). A use-after-free occurs when an object associated with extension handling is freed while a stale reference is still held; if an attacker can influence the contents of the freed memory region through a crafted HTML page, they can redirect control flow within the renderer process. Because the Extensions code is part of the standard browser and requires no privileges to trigger, any desktop Chrome build below 156.0.8078.47 running a default configuration is attackable over the network once the victim loads the malicious page. The impact is bounded by Chrome's renderer sandbox: code execution occurs 'inside the sandbox' (scope unchanged, S:U), so escaping to the host operating system requires chaining a second, independent sandbox-escape bug. Public reporting tags the issue as remote code execution, memory corruption, and denial of service, consistent with the crash-or-corrupt behavior typical of freed-object reuse in Blink/extension bindings.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N, visiting the page is UI:R, and renderer compromise is high C/I/A with S:U as no sandbox escape is described.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a high-severity use-after-free in the Extensions component that can let a crafted HTML page execute code within the renderer sandbox when a user interacts with it. The flaw is bounded by Chrome's sandbox, so full host compromise would require an additional exploit, but broad browser deployment and user-driven attack paths make timely patching a leadership-level priority. A vendor patch is available and no public exploit was identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB