EUVD-2026-105553
GHSA-x5qq-3pgw-25q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers ContextualSearch use-after-free
-
ExecutionReclaim freed object for control
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 156.0.8078.47 and to load attacker-controlled HTML that exercises the ContextualSearch feature, triggering the use-after-free; this maps to the UI:R user-interaction requirement in the CVSS vector. The key LIMITING factor is that, per the vendor description, resulting code execution is contained 'inside the sandbox' (renderer process) - so without an additional, separate sandbox-escape vulnerability the attacker does not gain code execution on the host OS. No authentication is required (PR:N), and no non-default configuration is called out, but the mandatory victim navigation and the sandbox boundary meaningfully constrain realistic impact. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) points to a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - a realistic bar for a web browser. However, two signals pull the real-world priority DOWN: (1) Google/Chromium labels this 'Medium' severity, and (2) the description explicitly states code execution occurs 'inside the sandbox,' meaning a successful exploit is confined to the renderer process and does NOT by itself yield host compromise - it would need to be chained with a separate sandbox-escape bug to be fully weaponized. This tension between the 8.8 CVSS and the Medium vendor rating is important: the CVSS does not model Chrome's sandbox as a scope boundary (S:U), so it arguably overstates standalone impact. EPSS score is NOT provided in the input and cannot be asserted. KEV status is NOT listed (no CISA KEV entry supplied) and no POC is indicated, so this is: no public exploit identified at time of analysis. Net: a genuinely patch-worthy memory-corruption bug in ubiquitous software, but as a single sandboxed-renderer UAF it is a moderate priority rather than an emergency, absent evidence of a paired sandbox escape or active exploitation. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing markup that triggers the ContextualSearch use-after-free; when a Chrome user before 156.0.8078.47 navigates to it (the required user interaction), the freed object is reused to achieve arbitrary code execution within the sandboxed renderer process. No public exploit code is identified in the provided data, and execution is confined to the sandbox unless combined with a separate escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's ContextualSearch component (all versions prior to 156.0.8078.47) allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a low-complexity, network-reachable flaw whose only prerequisite is victim navigation; however, per the vendor description, the resulting code execution is confined to the renderer sandbox, so host-level compromise requires a separate sandbox-escape vulnerability. Chromium rates this a Medium-severity issue, no public exploit code was identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47, distributed via the Stable Channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. End users should relaunch Chrome so the pending update applies, and verify the installed build via chrome://version; most installations auto-update within hours to days, so the practical exposure window is the relaunch gap. Enterprises should force the update through Google Update / their browser management console and confirm fleet-wide version compliance before closing the change. Third-party Chromium browsers require their own vendor releases - track their advisories rather than assuming the Chrome build number applies. No patch-absent workaround is documented in the supplied data, so compensating controls are limited: keep the renderer sandbox and Site Isolation enabled (both default, and the reason this bug is contained to the sandbox), avoid relaxing sandbox or --no-sandbox flags on managed endpoints, and, where an enterprise policy exists to disable the ContextualSearch feature, consider disabling it as a stopgap - accepting the trade-off that users lose contextual search suggestions until the browser is patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (use-after-free), a memory-corruption class in which an object - here, state associated with Chrome's ContextualSearch feature, which surfaces contextual/lens-style search suggestions for page content - is deallocated while a live pointer to it remains. Attacker-supplied HTML drives the feature down a code path that dereferences the dangling reference, letting the attacker shape heap contents and potentially redirect control flow within the renderer process. Because Chrome's multi-process architecture places the renderer in a restricted sandbox, the immediate consequence is arbitrary code execution in a low-privilege context; the impact chain would only extend to the host OS if chained with a distinct sandbox-escape bug. Exploitation requires the victim to browse to attacker-controlled content (UI:R), and no credentials or non-default configuration are needed (PR:N).
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no privileges, but requires victim navigation (UI:R); code execution is sandbox-confined so scope stays unchanged (S:U) while renderer C/I/A are high.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome releases before 156.0.8078.47 contain a high-severity ContextualSearch use-after-free that can allow an unauthenticated attacker to execute code inside the browser sandbox when a user visits a crafted HTML page. The business exposure is broad because Chrome is widely deployed and the flaw requires only user navigation, but the described code execution is sandbox-confined and no public exploit was identified at time of analysis, so host compromise would require an additional sandbox-escape vulnerability. Leadership should treat this as a patch-priority event for the browser fleet rather than a confirmed active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB