EUVD-2026-105664
GHSA-2m7c-pqq9-c4hf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
DeliveryDeliver crafted HTML/CSS content
-
ExploitTrigger use-after-free in CSS engine
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactCompromise browser renderer process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires user interaction (CVSS UI:R): the victim must load an attacker-crafted HTML page in a vulnerable Chrome build prior to 156.0.8078.47; no authentication or special configuration is needed since this affects default Chrome rendering. The key limiting factor is sandbox containment - the description states code execution is 'inside the sandbox,' so this flaw alone compromises only the renderer process and a separate sandbox-escape vulnerability is required for host compromise. Risk is further bounded by Chrome's automatic update mechanism, which rapidly reduces the exposed population once the stable channel update propagates. |
| Impact | All provided signals are internally consistent and point to a serious but not emergency-level issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity, unauthenticated memory-corruption bug (CWE-416 use-after-free in the CSS engine) that requires user interaction - the victim must load a crafted HTML page. A critical qualifier in the description tempers the raw score: arbitrary code execution occurs 'inside the sandbox,' meaning this bug alone compromises the renderer process, not the host; full system compromise requires chaining a separate sandbox-escape, which is why Google's own Chromium severity rating is only 'Medium' despite the 8.8 CVSS. No EPSS probability, CISA KEV listing, or public POC is present in the input, so there is no evidence of active or imminent exploitation (no public exploit identified at time of analysis). Net assessment: a genuine patch-priority browser vulnerability given Chrome's ubiquity and the low exploitation complexity, but not a drop-everything emergency - it is neither KEV-listed nor POC-backed, and sandbox containment limits standalone impact. Note the conflict between the 8.8 'High' CVSS and the vendor 'Medium' rating; the vendor rating accounts for sandbox containment that the generic CVSS does not. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/CSS and lures a victim to visit it (e.g., via phishing or malvertising). When the victim's pre-156.0.8078.47 Chrome renders the page, the CSS engine frees and then reuses memory (use-after-free), letting the attacker execute arbitrary code within the renderer sandbox. No public exploit code is identified at time of analysis, and the attacker would still need a separate sandbox escape to affect the host system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's CSS handling lets a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation requires user interaction (CVSS UI:R) - visiting or being redirected to a malicious or compromised page - but no credentials or non-default configuration, since the flaw sits in the default rendering path. The impact is bounded: the description specifies code execution 'inside the sandbox,' so host compromise needs a separate sandbox escape, and no public exploit code or confirmed active exploitation was identified at time of analysis. Google shipped a stable-channel fix in 156.0.8078.47, and Chrome's automatic updater sharply shrinks the exposed population once that build propagates.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 (or later) via the stable-channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Chrome's background updater normally applies this automatically, but the update only takes effect after a browser relaunch, so verify the installed version at chrome://settings/help and force a restart where the build still reports an older number - the trade-off is a brief interruption of open tabs and sessions, which can be scheduled. Organizations managing fleets should push 156.0.8078.47 through their patch-management or browser-update tooling and track compliance, since the exposed population is defined purely by build version. Where an immediate fleet-wide upgrade is not feasible, the most effective compensating control is to keep the renderer sandbox intact and unweakened (no --no-sandbox flags, no disabled site isolation) so that the worst case stays a sandboxed renderer compromise rather than host compromise; the trade-off is reduced compatibility with unusual enterprise web apps that already require relaxed flags. Restricting users to curated, trusted web properties and blocking broad untrusted browsing through policy or a secure web gateway lowers exposure to crafted pages but is high-friction and prone to false positives, so it is a stopgap rather than a substitute for upgrading. There is no configuration switch that disables the affected CSS functionality without breaking page rendering, so no feature-level workaround exists. Monitor the Chromium issue tracker at https://issues.chromium.org/issues/562230438 for any later disclosure of exploit activity; no vendor-released patch gap is known at this time.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's CSS implementation, part of the Blink rendering engine's style parsing and resolution pipeline. A use-after-free means an object is released while a live reference to it still exists, leaving a dangling pointer that attacker-influenced page content can cause the renderer to dereference; in a browser engine this typically corrupts heap state and can be steered toward control-flow hijack within the renderer process. Because the attack surface is CSS embedded in an HTML page, no plugin, extension, or elevated privilege is needed - only that the victim renders the crafted markup. Note the tension between signals: Google's own Chromium severity rating for this bug is Medium, while the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H arithmetically yields 8.8. That gap is explained by sandbox containment - the 8.8 vector scores the renderer compromise (scope unchanged, full C/I/A on that component) and does not price in the additional, independent vulnerability required to break out of the sandbox to the host. Public technical detail is limited to the Chromium issue tracker entry (562230438), which is access-restricted, so no root-cause specifics beyond the CSS use-after-free class and the affected component are available.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; victim must load the page so UI:R; renderer-only code execution keeps S:U with full C/I/A in that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds before 156.0.8078.47 are exposed to a high-severity flaw that could allow code execution within the browser’s renderer sandbox when an employee visits a crafted page. The risk is broad because Chrome is widely deployed, but it is bounded by the sandbox and requires user interaction; no public exploit identified at time of analysis. Leadership should prioritize rapid fleet update to reduce exposure while recognizing that host compromise would require an additional sandbox escape.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB