EUVD-2026-105473
GHSA-q337-p577-jxf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitPage triggers use-after-free in Paint
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in a vulnerable Chrome build (prior to 156.0.8078.47) that exercises the Paint/rendering code path - i.e., the user must navigate to or render a crafted HTML page (CVSS UI:R). No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected since page rendering is core browser functionality. The primary LIMITING factors are: (1) mandatory user interaction (visiting/rendering the malicious page), and (2) the resulting code execution is confined to the renderer sandbox (S:U), so host-level compromise additionally requires a separate sandbox-escape vulnerability. |
| Impact | This is a genuine high-priority patch item, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity, unauthenticated code execution requiring only that a victim load a crafted HTML page - a trivially met condition for a web browser. CWE-416 (use-after-free) in the Paint component is a classic, reliably exploitable memory-corruption primitive, and Chrome's enormous install base makes it an attractive target. Countervailing signals keep this below the absolute top tier: the description explicitly states code execution occurs 'inside the sandbox' (S:U, no scope change), so a successful exploit yields control of the renderer process only and would need a separate sandbox-escape chain for full host compromise. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no current evidence of in-the-wild or widespread exploitation. The 'Denial Of Service' tag is a secondary consequence of the UAF, not the primary impact - the description is unambiguously remote code execution. Net: patch urgently because of ubiquity and ease of triggering, while recognizing exploitation is sandbox-constrained and not yet confirmed active. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/CSS that forces Chrome's Paint subsystem to reuse freed memory, then lures a victim to visit it (e.g., via phishing, malvertising, or a watering-hole site). When the page renders, the use-after-free is triggered and the attacker gains arbitrary code execution within the Chrome renderer sandbox. No public exploit code is referenced, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Chrome's Paint rendering component lets a remote attacker execute arbitrary code inside the renderer sandbox by getting a victim to open a crafted HTML page in any build prior to 156.0.8078.47. No privileges or credentials are needed, but the attacker must convince the user to render the malicious content (CVSS UI:R), and because the score is scoped to the renderer (S:U), full host compromise would additionally require a separate sandbox escape. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor has released a fixed build, so this is a genuine high-priority patch item for browser fleets rather than a theoretical memory-safety bug.
RemediationAI
Primary fix: upgrade to the vendor-released patch, Google Chrome 156.0.8078.47 (Stable channel), per https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; ChromeOS users should apply the corresponding Stable update at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html. Note that Chrome applies updates on restart, so verify the running version after relaunch rather than assuming the download completed - leaving browsers on an older build is the most common failure mode for this class of fix. Until patching completes, keep Site Isolation and the renderer sandbox enabled (do not use --no-sandbox or disable site isolation, which would convert a renderer-scoped bug into host-level exposure), and restrict or proxy untrusted web browsing for high-value users, accepting the productivity trade-off. Blocking or filtering on the Chrome user-agent string only forces users onto other browsers and offers limited real protection, and disabling Paint/compositing features is not a supported configuration. No vendor-released patch workaround is documented; there is no evidence of public exploit code, so prioritized routine patching is appropriate rather than emergency containment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free (memory corruption class) in the Paint stage of Chromium's rendering pipeline, the Blink code that turns the layout tree into paint operations and composited layers. A dangling reference to a Paint-related object is retained after it is freed, so the attacker-controlled HTML/DOM/CSS structures can shape heap state and redirect execution flow through the freed object - the classic pattern that yields reliable remote code execution inside Chrome's renderer. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-delivered, low-complexity attack with no authentication, gated only by user interaction, and with impact confined to the renderer's security scope (Scope: Unchanged). Chrome's multi-process sandbox is the backstop here, meaning successful exploitation gives code execution as the renderer process rather than the host; defeating that boundary is a separate problem. ChromeOS builds on the same Chromium rendering stack and therefore inherits the underlying defect even though the tracked product is the desktop browser.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no auth (PR:N) but requires victim to load it (UI:R); UAF yields in-sandbox code execution with high C/I/A and no scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity use-after-free in the Paint rendering component that can allow a crafted HTML page to run attacker code inside the browser renderer when a user opens malicious content. Host takeover would require an additional sandbox escape, and no public exploit identified at time of analysis, but the broad Chrome footprint makes this a priority fleet-patching issue for security leadership.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB