EUVD-2026-105763
GHSA-f94x-72mf-xpvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Editing
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (any version before 156.0.8078.47) that exercises the Editing component - so user interaction (visiting/opening the page) is the primary gating factor, reflected in UI:R. No authentication or special privileges are needed (PR:N). The decisive limiting factor is that code execution is confined to the renderer sandbox: full host compromise requires chaining with a separate sandbox-escape vulnerability, which is why Google rates the standalone issue 'Low'. Users on 156.0.8078.47 or later, or with the stable channel auto-update applied, are not exposed. |
| Impact | Signals conflict sharply and must be reconciled before prioritizing. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a remotely reachable, low-complexity, unauthenticated memory-corruption bug needing only that a victim open a crafted page - classic drive-by territory. However, Google's own Chromium security severity rating is 'Low', and the description explicitly states code execution occurs 'inside the sandbox' (consistent with S:U, scope unchanged), meaning the attacker gains code execution in the restricted renderer process rather than full host compromise. That is the key tension: the 8.8 base score overstates real-world impact because it does not credit the Chrome sandbox, while Google's 'Low' rating reflects that a sandbox escape would be required to do meaningful damage. There is no EPSS score, no CISA KEV listing, and no public POC referenced - no public exploit identified at time of analysis. No SSVC decision data was supplied. Net assessment: this is a patch-on-normal-cadence browser bug, not an emergency. Treat it as a routine Chrome update priority rather than a high-urgency item, while recognizing that UAF renderer bugs are frequently chained with a separate sandbox-escape to achieve full RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing HTML that triggers the use-after-free in Chrome's Editing component; a victim running a pre-156.0.8078.47 build visits it and the attacker gains arbitrary code execution confined to the renderer sandbox. No public exploit code is identified at time of analysis, and the attack requires user interaction (loading the page). To reach the host, this would typically need to be chained with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Editing component (all builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is gated entirely by user interaction - the target must visit or open the attacker-supplied page - and the resulting code execution is confined to the Chrome renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug; Google consequently rates the standalone issue as Chromium severity 'Low' even though the generic CVSS 3.1 vector scores 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied, so the practical priority hinges on reconciling the high vector score with the sandbox-limited, interaction-dependent impact.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later. The reliable path is the built-in stable-channel auto-update, followed by a full browser restart (a restart is mandatory - closing and reopening tabs on the same running process does not load the patched binary); confirm the running build via chrome://version or the enterprise version report. For managed fleets, push 156.0.8078.47 through Chrome Browser Cloud Management, Google Update policy, or your software distribution tooling with an enforced relaunch, and audit for hosts that have been offline or have update services disabled. No configuration-level workaround removes the flaw, and mitigations carry real trade-offs: disabling JavaScript broadly breaks most web applications, and restricting users to an allowlist of sites reduces exposure only to the extent that the allowlist itself is free of attacker-influenced content. The most valuable compensating control is to keep the renderer sandbox and Site Isolation enabled and fully patched across all channels, since the assessed impact is capped at in-sandbox code execution and a chained sandbox-escape is what would elevate this to host compromise; disabling the sandbox to 'fix' compatibility issues would convert a Low-severity vendor bug into a High-severity exposure and should not be done. Track the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html for any follow-up fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) in Chrome's Editing subsystem, the Blink/DOM layer that implements contenteditable regions, text-input handling, and document editing commands. A crafted HTML page can drive the editing code path into referencing a heap object after it has been freed and reallocated, producing attacker-influenced memory corruption - typically a controlled read/write primitive inside the renderer process that can be converted into arbitrary code execution in the sandboxed renderer. Because the corruption is reachable purely through page content, no credentials or elevated privileges are required (CVSS PR:N, AV:N/AC:L), but the UI:R metric reflects that the victim must actually load the malicious document. The critical architectural constraint is Chrome's multi-process sandbox: renderer-level code execution does not by itself yield operating-system access, which is why the vendor's own Chromium severity rating is Low while the flat CVSS vector reads 8.8/High. Chrome's Site Isolation and the renderer sandbox are the effective blast-radius controls here; the risk profile changes materially only if this bug is paired with a sandbox-escape chain.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); scope unchanged since execution stays within the renderer sandbox, yet in-process confidentiality/integrity/availability impact is high.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
CVE-2026-113227 is a use-after-free in Google Chrome's Editing component affecting builds prior to 156.0.8078.47; a crafted HTML page could execute code inside the renderer sandbox after user interaction. Because impact is sandbox-limited and requires a victim to open the page, the standalone business risk is narrower than the 8.8 CVSS score implies, but broad Chrome deployment still warrants coordinated patching. No public exploit identified at time of analysis, and leadership should track remediation to reduce exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB