EUVD-2026-105555
GHSA-p748-jh57-86wg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
ExploitServe crafted HTML to Chrome
-
ExecutionTrigger Core memory corruption (CWE-119)
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 and to load attacker-controlled crafted HTML (UI:R - user must visit/open the malicious page); no authentication or special configuration is needed against default Chrome installs. The key limiting factor is that resulting code execution is contained within the renderer sandbox per the vendor description, so standalone host compromise is not demonstrated and would require chaining an additional sandbox-escape vulnerability; auto-updating Chrome channels also shorten the exposure window once the stable update is applied. |
| Impact | Signals are moderately consistent but point to a patch-priority rather than emergency item. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 (High), reflecting network reach, low attack complexity, no privileges, and only user interaction (visiting a crafted page) as a gate. However, Google/Chromium rated the issue only 'Medium' severity, and the description is explicit that code execution occurs INSIDE the sandbox - i.e. no sandbox escape to the host is claimed - which materially lowers real-world impact versus what the C:H/I:H/A:H + 8.8 score implies. This CVSS-vs-vendor-severity divergence should be weighed: the 8.8 treats in-sandbox code execution as full confidentiality/integrity/availability compromise, while in practice a sandboxed renderer compromise typically requires chaining a second escape bug for host impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate patch-now item given Chrome's ubiquity and the low complexity, but not a confirmed-exploited crisis, and the headline 8.8 overstates standalone impact because exploitation is sandbox-contained. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the Core memory-corruption flaw when a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits it. Successful exploitation yields arbitrary code execution confined within the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape bug for host compromise. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Core component of Google Chrome desktop builds prior to 156.0.8078.47 lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No authentication or non-default configuration is needed - the only prerequisite is that the user loads the malicious page in an unpatched browser. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the resulting code execution is confined to the renderer sandbox, full host compromise would require chaining a separate sandbox-escape flaw; Google has shipped a stable-channel fix, making this a patch-priority item rather than an emergency one.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later - the fix is delivered through the standard stable-channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Confirm the running build via chrome://version and relaunch the browser, since Chrome applies updates on restart; enterprises should force the version through their update policy (e.g., Chrome Browser Cloud Management version pinning or an MDM/package-management push) and verify fleet compliance before relaxing any interim controls. Where immediate patching is not possible, keep the renderer sandbox and Site Isolation enabled (both default - disabling them, as some troubleshooting guidance suggests, would convert a sandboxed code-execution bug into host-level risk and must be avoided), restrict or block browsing to untrusted sites and unsolicited HTML attachments at the proxy/email gateway (trade-off: reduced user flexibility and possible false positives on legitimate content), and consider running high-risk browsing in a disposable VM or remote isolation service until the update lands (trade-off: added latency and infrastructure cost). Note that blocking JavaScript or JIT would reduce exposure but breaks most modern web applications and is not a practical fleet-wide control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 improper restriction of operations within the bounds of a memory buffer, occurring in Chrome's 'Core' component - the umbrella designation Google uses in stable-channel release notes for memory-safety fixes in the browser engine/rendering pipeline that processes untrusted web content. Because the corruption is reachable from parsed HTML, the attack surface is the renderer process, which Chrome isolates per-site under its multi-process sandbox architecture. Successful exploitation therefore yields arbitrary code execution with the privileges of the renderer (sandboxed), so an attacker must additionally defeat the sandbox (e.g., via an IPC or OS-level escape) to reach the host - which is why the vendor rates it only Medium under Chromium's severity guidelines despite the 8.8 CVSS base score derived from high confidentiality/integrity/availability impact. Exploitation is unauthenticated over the network but requires user interaction (UI:R), since the victim must navigate to or be lured to the crafted page; Chrome's auto-update channels materially shorten the exposure window once 156.0.8078.47 is deployed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); scope unchanged as execution stays within the renderer sandbox, with high impact to that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A high-severity memory-corruption defect in Google Chrome desktop releases prior to 156.0.8078.47 gives a remote attacker a path to code execution inside the renderer sandbox if an employee opens a crafted web page. Because the flaw requires only user browsing and Chrome is widely deployed, leadership should prioritize rapid browser remediation across the endpoint estate, while noting that no public exploit identified at time of analysis and host-level compromise would require an additional sandbox escape.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB