EUVD-2026-105702
GHSA-x44q-mv23-38mr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in DevTools
-
ExecutionRead adjacent memory within sandbox
-
ImpactExfiltrate leaked in-process data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted HTML page in Google Chrome versions prior to 156.0.8078.47, exercising the DevTools code path that contains the memory-corruption flaw (CWE-119). Limiting factors: user interaction is mandatory (UI:R) - the victim must navigate to the malicious page - and impact is confined to reading memory INSIDE the renderer sandbox, with no sandbox escape, no integrity change, and no availability loss. No authentication is required (PR:N). The bounded, sandbox-local read is why Chromium rated the security severity 'Low' despite a network-reachable vector. |
| Impact | Signals are consistent and point to a genuinely LOW-priority issue despite the 6.5 (Medium) CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, with confidentiality-only impact and no scope change. This aligns with the description: a crafted HTML page can trigger memory corruption in DevTools to read memory, but only inside the renderer sandbox (no integrity/availability impact, no sandbox escape). Chromium itself rated the security severity 'Low,' which conflicts with the CVSS C:H rating - reading memory confined to the sandbox is a bounded information leak, not full host confidentiality compromise, so C:H appears generous. EPSS reinforces low real-world urgency: 0.22% probability (12th percentile). It is NOT in CISA KEV and there is no public exploit indicator in the data, so this is not under active exploitation. No SSVC decision data was provided. Net: not a drop-everything priority - patch via normal Chrome auto-update cadence. The only amplifier is prevalence (Chrome is ubiquitous), so even a low-severity bug warrants routine patching at scale. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a Chrome user into opening it (with DevTools behavior being triggered), causing a memory-corruption condition that lets the page read adjacent memory within the renderer sandbox. The leaked bytes could include sensitive in-process data but remain confined to the sandbox. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to visit the attacker-controlled page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the DevTools component of Google Chrome before 156.0.8078.47 permits a remote attacker to read memory within the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the attacker's page) and no authentication, but the impact is bounded to disclosure inside the sandbox with no escape, no data modification, and no availability loss - which is why Chromium assigned a Low severity. There is no public exploit identified at time of analysis, and EPSS is very low at 0.22% (12th percentile), consistent with the low-severity, interaction-dependent nature of the flaw.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html); most installs update automatically, but verify the reported version from chrome://version and force a relaunch so the new build is actually running. Chromium-based browsers and embedded Chromium frameworks should follow their vendors' equivalent fixed builds once the upstream patch is merged. If immediate upgrading is impractical, restrict use of DevTools on untrusted content and reduce exposure by keeping high-risk browsing in a separate, up-to-date browser profile - noting this lowers but does not eliminate exposure, since the flaw is reachable from ordinary page rendering. Organizations prioritizing by risk can defer urgent out-of-band action given the Low severity, EPSS of 0.22%, absence of public exploit code, and the sandbox-confined read-only impact, while tracking patch compliance through normal update cycles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer affecting Chrome's DevTools code path. DevTools is Chromium's built-in developer tooling, and the vulnerable handler processes content reachable from web pages; a crafted HTML document can drive the affected code into an out-of-bounds memory access. Because it is a read primitive confined to the renderer process sandbox, the realistic outcome is disclosure of renderer-process memory rather than code execution or privilege elevation. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N captures this: network reachable and low complexity, but interaction-gated and scope-unchanged with confidentiality-only, low impact. Our assessment rates confidentiality Low rather than the NVD-style C:H, reflecting the sandbox-local read limitation; consumers of the score should treat 6.5 as an upper bound rather than an accurate risk signal here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable crafted page with no auth (PR:N) but mandatory user interaction (UI:R); only a sandbox-confined memory read, so C:L (not C:H) and I/A none.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB