EUVD-2026-105482
GHSA-247w-cwv4-5wrv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Internals
-
ExecutionReclaim freed object via heap grooming
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim running Google Chrome on macOS at a version prior to 156.0.8078.47 to open or be redirected to an attacker-crafted HTML page (UI:R) - no authentication or prior privileges are needed. Key limiting factors: the victim must actively load the malicious page, exploitation is restricted to macOS builds, and the resulting arbitrary code execution is contained within the renderer sandbox, so meaningful host-level compromise requires an additional sandbox-escape vulnerability. This sandbox containment is why Google rates the issue Medium despite the High CVSS. |
| Impact | Signals are moderately but not uniformly elevated. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, yielding a 'High' base score - yet Google's own Chromium severity rating is only 'Medium', a notable conflict driven by the fact that code execution is confined to the renderer sandbox rather than achieving full host compromise. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis'. The practical risk is tempered by two factors: exploitation requires the victim to open a crafted HTML page (UI:R), and success grants code execution only inside the sandbox, meaning a separate sandbox-escape chain is needed for real-world system takeover. Net assessment: a real but not emergency-priority browser memory-corruption bug - patch on normal Chrome update cadence; the 8.8 number overstates standalone impact because it does not reflect the sandbox containment that Google's Medium rating captures. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing JavaScript/HTML that triggers the use-after-free in Chrome's Internals component. A macOS user running Chrome prior to 156.0.8078.47 visits the page, the freed object is reclaimed and manipulated, and the attacker gains arbitrary code execution within the renderer sandbox. No public proof-of-concept was identified in the provided data; full host compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Internals component on macOS lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, and Google has released Chrome 156.0.8078.47 to fix it. The bug is remotely reachable without credentials but requires the user to open or be redirected to attacker-controlled content (UI:R), is limited to macOS builds, and yields code execution confined to the sandbox - host-level compromise would need a separate sandbox escape, which is why Chrome rates it Medium despite a High 8.8 CVSS. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in targeted phishing or watering-hole delivery against macOS Chrome users.
RemediationAI
Vendor-released patch: 156.0.8078.47 - upgrade Google Chrome on macOS to that build or later via chrome://settings/help (Relaunch to apply) or by deploying the updated macOS package through Chrome Enterprise / managed software distribution, as described in the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Because exploitation requires the user to load a crafted page, interim mitigations are limited to reducing exposure until the update lands: keep Site Isolation and the renderer sandbox enabled (disabling either for debugging removes the primary containment boundary and is not recommended), and block untrusted or newly registered domains via an HTTP proxy or DNS filtering policy - accepting the trade-off of false positives on legitimate sites. Organisations that cannot patch immediately can restrict access to browser-internal pages such as chrome://internals through Chrome Enterprise URL blocklists, though this is a narrow control since the flaw is reachable from ordinary web content rather than from a user-typed internal URL. Track the Chromium issue at https://issues.chromium.org/issues/441089142 for any follow-up detail, and treat unpatched macOS endpoints as exposed to drive-by phishing lures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free: a heap object in Chrome's Internals implementation is freed while a reference to it survives, so subsequent attacker-influenced operations dereference reclaimed memory. Because Chrome is written in C++ with manual memory management, such dangling pointers are the classic route to memory corruption in the renderer process, typically weaponized by heap grooming (reclaiming the freed slot with a controlled object) to hijack control flow or corrupt adjacent data. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a network-delivered, unauthenticated attack that depends on victim interaction and yields high confidentiality, integrity and availability impact within the affected component's security scope. Exploitation is bounded by Chrome's multi-process architecture: the compromised renderer sits behind the sandbox and Site Isolation, so arbitrary code execution occurs inside the sandbox and escalating to the operating system requires chaining a second, independent sandbox-escape flaw. EUVD records the affected range as Chrome releases prior to 156.0.8078.47; the macOS-only scoping in the description reflects platform-specific object layout or component code paths.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to visit it (UI:R); renderer code execution yields high C/I/A within the sandboxed process, scope unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A high-severity use-after-free in Google Chrome's Internals component on macOS can let crafted web content execute code inside Chrome's renderer sandbox, affecting macOS Chrome users who are induced to open malicious or compromised pages. Organizational exposure is concentrated in targeted phishing or watering-hole delivery because exploitation requires user interaction and remains confined to the renderer sandbox; no public exploit identified at time of analysis. Leadership should prioritize updating macOS Chrome endpoints to vendor-fixed Chrome 156.0.8078.47 to reduce risk to browsing users.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB