EUVD-2026-105556
GHSA-9fwv-9f4q-wwhq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Chrome Core
-
ExecutionEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-controlled web page containing crafted HTML/JavaScript in Chrome prior to 156.0.8078.47 - this user interaction (UI:R) is the primary limiting factor; there is no zero-click or unattended vector. No authentication is required (PR:N) and no special non-default browser configuration is indicated, so default Chrome installs on the affected versions are exposed when a user visits the malicious page. The scope change (S:C) corresponds to the described escape of the renderer sandbox, meaning successful exploitation reaches beyond the browser's sandboxed process to the host. |
| Impact | Signals conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a remotely reachable, low-complexity, unauthenticated memory-corruption flaw whose scope change (S:C) reflects the stated sandbox escape - a genuinely serious combination. However, Chromium's own triage rates this 'Medium', a notable divergence from the 9.6 base score; the Chromium rating typically reflects exploitability/reachability nuance, so the 9.6 likely overstates day-one real-world risk. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis. Exploitation requires user interaction (UI:R) - the victim must load attacker-controlled HTML - which meaningfully limits mass, drive-by-at-scale exploitation compared to a zero-click bug. SSVC framing: technical impact is total (code execution outside the sandbox), but exploitation is not observed and automatability is constrained by the required user interaction. Net: a patch-promptly item for any Chrome fleet given ubiquity and RCE potential, but currently NOT evidenced as actively exploited; treat the 9.6 as a ceiling and the Chromium 'Medium' as a tempering signal pending further exploitation intelligence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers a use-after-free in Chrome's Core component, then lures a victim (via link, ad, or malvertising) to visit it. Successful exploitation corrupts memory to achieve arbitrary code execution that escapes the renderer sandbox and runs on the host. No public exploit code is identified at time of analysis, and the attack requires the user to open the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome Core before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page, with the required user interaction being the main limiting factor. Default desktop Chrome installations on affected versions are exposed if a user visits the malicious page; successful exploitation crosses the sandbox boundary and can affect the host. Vendor-released patch: 156.0.8078.47, and no public exploit identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later; the vendor-released patch is available and should be delivered through Chrome's standard update mechanism, with the installed version verified via chrome://version. The Chrome stable channel advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium tracking issue is https://issues.chromium.org/issues/514016335. If immediate upgrade is not possible, restrict affected Chrome builds to trusted sites, isolate browsing in a disposable or tightly controlled environment, and enforce enterprise browser update policy; these measures reduce exposure to crafted pages but do not remediate the underlying use-after-free or the sandbox-escape risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-113189 is a CWE-416 use-after-free in Chrome's Core component, meaning a memory object can be freed while a stale pointer remains and is later dereferenced under attacker-influenced heap conditions. Chrome's multi-process design normally confines web content to a renderer sandbox, but this flaw is described as enabling code execution outside that sandbox, which is why the CVSS vector carries S:C in addition to C:H/I:H/A:H. The attack path is a crafted HTML page loaded by the victim (AV:N/AC:L/PR:N/UI:R), so exploitation is remote and unauthenticated but depends on user interaction rather than a zero-click vector. The EUVD data places affected builds before 156.0.8078.47; no CPE strings were provided in the supplied intelligence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted HTML (AV:N/AC:L/PR:N), victim must open the page (UI:R), and sandbox escape justifies S:C with full C/I/A host impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop deployments face a critical sandbox-escape flaw that could let a crafted web page compromise the underlying host, putting endpoint integrity and sensitive data at risk. Because Chrome is widely used and exploitation depends on ordinary user browsing, leadership should prioritize rapid version verification and patch enforcement across the organization. No public exploit has been identified at time of analysis, but the potential for host-level compromise warrants immediate remediation, and Google has released Chrome 156.0.8078.47 to address the issue.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB