EUVD-2026-105593
GHSA-j43x-w3xj-cq8x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in BrowserTag
-
ExecutionReuse freed object to control memory
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to load attacker-controlled HTML that exercises the BrowserTag component (UI:R - the user must visit/open the crafted page); no authentication or prior privileges are needed (PR:N). The key LIMITING factor is that successful exploitation yields code execution only inside the Chrome renderer sandbox - not on the host OS - so meaningful host compromise additionally requires a separate sandbox-escape vulnerability. Patched builds (156.0.8078.47 and later) are not affected. |
| Impact | Signals are mixed and should be read carefully. The NVD CVSS 3.1 base score is 8.8 (High) with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N) requiring only user interaction (UI:R) - i.e., a victim visiting a crafted page. However, Google's own Chromium security severity rating is 'Medium', and the description explicitly scopes code execution to 'inside the sandbox,' meaning this is a renderer-level compromise that does NOT by itself escape Chrome's sandbox to reach the host OS; full-host RCE would require chaining with a separate sandbox-escape bug. EPSS probability is NOT provided in the input and cannot be stated. KEV status is not present (no CISA KEV listing), and no POC or exploit code is referenced, so there is no public exploit identified at time of analysis. The conflicting signals - High NVD CVSS versus vendor Medium, plus sandbox-confined impact - suggest this is a genuine but second-tier priority: important to patch promptly given Chrome's ubiquity and the ease of drive-by delivery, but not an emergency single-bug host-takeover absent an exploit chain or active-exploitation evidence. Treat the 8.8 as reflecting in-sandbox C/I/A loss, not host compromise. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's BrowserTag component; a victim running a pre-156.0.8078.47 build visits the page (e.g., via phishing link or malvertising) and the freed object is reused, giving the attacker arbitrary code execution within the renderer sandbox. No authentication is required (PR:N) but user interaction is (UI:R: the victim must load the page). No public POC or exploit code is referenced in the available intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's BrowserTag component, affecting desktop builds prior to 156.0.8078.47, allows remote unauthenticated attackers to execute arbitrary code inside the Chrome renderer sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Because code execution is confined to the renderer sandbox, full host compromise would additionally require a separate sandbox-escape vulnerability, which limits the practical blast radius. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the high base score.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, distributed through the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; confirm the installed build via chrome://version and ensure the browser is fully restarted so the updated binary is loaded, then verify version compliance across all desktop endpoints through your software inventory or enterprise update tooling. Where immediate patching is not possible, compensating controls should target the user-interaction prerequisite and the sandbox boundary: route high-risk or untrusted browsing through remote browser isolation or a hardened virtualized browser session (trade-off: added latency and reduced usability for rich web applications); enforce URL/content filtering and block delivery of untrusted HTML from unknown origins (trade-off: incomplete coverage and potential false positives on legitimate sites); confirm the Chrome sandbox and site isolation remain enabled and avoid launching Chrome with --no-sandbox or disabled site isolation, which would convert renderer-only code execution into host-level risk (trade-off: some legacy or embedded web apps may break under strict isolation); and restrict administrative users from browsing untrusted content on privileged workstations (trade-off: operational friction). Because exploitation requires a victim to open a crafted page, user awareness of unsolicited links and attachments provides only marginal risk reduction and should not substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) in Chrome's BrowserTag implementation, a memory-safety defect in which an object's backing memory is freed while a reference to it is still held, leaving a dangling pointer that an attacker can influence through crafted HTML parsed in the renderer. The affected technology is Chromium's multi-process browser architecture: web content is parsed and rendered inside a heavily sandboxed renderer process, and BrowserTag objects are managed within that renderer context. Successful corruption of freed heap memory gives an attacker the primitives needed for controlled memory writes and ultimately arbitrary code execution within the renderer process. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows the attack is network-delivered, low complexity, requires no credentials or prior privileges, but depends on user interaction because the victim must visit or open the attacker-controlled page. Crucially, the impact is scoped to the sandboxed renderer: escaping to the host operating system is not part of this CVE and would require chaining a distinct sandbox-escape flaw. The issue was reported through Google's chrome-cve-admin process and is tracked in Chromium issue 523201686 and EUVD-2026-105593.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must visit it (UI:R); scope unchanged since code stays within the sandboxed renderer (S:U), with high in-sandbox C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop deployments prior to 156.0.8078.47 contain a high-severity memory-safety flaw that could allow a crafted webpage to run code within the browser's renderer sandbox. All organizations with unpatched Chrome desktop users are affected, and leadership should prioritize remediation because browser compromises can disrupt productivity and create a foothold for follow-on activity, though the sandbox limits immediate host-level impact. No public exploit identified at time of analysis, and Google's internal severity rating is Medium despite the high base score.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB