EUVD-2026-105645
GHSA-jpqv-3c8p-p856
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in FileSystem
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in Chrome prior to 156.0.8078.47 that exercises the FileSystem component to trigger the use-after-free (CVSS UI:R - user interaction via navigating to a crafted HTML page). The key LIMITING factor is that code execution is confined to the renderer sandbox (Scope:Unchanged, 'inside the sandbox'), so standalone exploitation does not compromise the host OS without an additional sandbox-escape vulnerability; no authentication is needed (PR:N) and default browser configurations are affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a trivially achievable condition for any browser bug. However, the description explicitly scopes code execution to 'inside the sandbox,' and the Scope:Unchanged metric confirms there is no sandbox escape; a full compromise would require chaining this with a separate sandbox-escape bug. Chromium rated the security severity only Medium, which contrasts with the 8.8 CVSS and reflects that in-sandbox RCE alone has limited standalone impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so despite the high CVSS this is NOT confirmed as actively exploited or imminently weaponizable - the real-world priority is high patch-urgency (browsers are the primary attack surface and Google often fixes bugs under active probing) but not emergency-tier based on available signals. The 'Denial Of Service' tag is plausible for a use-after-free but the description emphasizes code execution, not DoS; treat DoS as a secondary rather than primary outcome. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into a site the victim visits) that exercises the FileSystem component in a way that triggers the use-after-free. When the victim's Chrome (older than 156.0.8078.47) renders the page, the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided data, and a separate sandbox-escape would be needed to reach the host OS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's FileSystem component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is network-reachable, low-complexity, and unauthenticated (CVSS 3.1 base 8.8, PR:N), but successful exploitation requires user interaction and remains scoped to the sandbox, so host compromise would need a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis; Google has released a vendor patch in Chrome 156.0.8078.47.
RemediationAI
Google has released a vendor patch in Chrome 156.0.8078.47; upgrade to that version or later and restart the browser so the new build takes effect, verifying the installed version via chrome://version. Enterprise administrators should push the stable-channel update through their software management tooling and confirm all managed endpoints have moved off builds prior to 156.0.8078.47. The vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is https://issues.chromium.org/issues/559795243. No specific component-level workaround is documented in the provided data; if patching is delayed, reducing exposure to untrusted HTML through browser isolation or restrictive browsing policies can lower the chance of a user loading a crafted page, but those controls carry usability and performance trade-offs and do not replace updating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free in Chrome's FileSystem handling: an object is freed while a stale reference remains, and a crafted HTML page can cause the browser to dereference that dangling pointer. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity, unauthenticated attack that requires the victim to interact with the page; Scope:Unchanged reflects that code execution is confined to the renderer sandbox, not the host OS. Affected builds are Google Chrome versions prior to 156.0.8078.47 (EUVD-2026-105645), and the issue is tagged as RCE, denial of service, memory corruption, and use-after-free. Google's Chromium security severity is Medium even though the CVSS base score is 8.8, and the vendor patch is available in the 156.0.8078.47 stable release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); sandbox-confined code execution keeps scope unchanged (S:U) with high C/I/A within the renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity memory corruption flaw in the FileSystem component that can allow a crafted web page to execute arbitrary code within the browser's renderer sandbox. Any employee using an unpatched Chrome build for web browsing, including remote and hybrid staff, is exposed, though impact is contained to the sandbox unless chained with a separate escape. Leadership should prioritize this because browser compromise is a common initial access vector and the fix is already available at low remediation cost.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB