EUVD-2026-105478
GHSA-3m23-9836-jx6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger improper input validation in Extensions
-
ExecutionCorrupt renderer process state
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled or compromised web page containing crafted HTML that exercises the Extensions component's input validation flaw (UI:R) - there is no fully automatic, interaction-free path. No authentication is needed (PR:N) and no special victim-side configuration is indicated beyond running an affected Chrome build (<156.0.8078.47). The principal limiting factor is that, per the description, resulting arbitrary code execution is contained 'inside the sandbox,' so full host compromise would additionally require a separate sandbox-escape vulnerability; browser auto-update to 156.0.8078.47 or later removes exposure. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) suggests a high-severity, network-reachable flaw requiring only that a victim open a crafted HTML page. However, there is a notable tension between signals: Google/Chromium rated this 'Medium' severity, and the description explicitly states code executes 'inside the sandbox,' which materially caps real-world impact - a sandboxed renderer compromise is not equivalent to host code execution and typically requires a second sandbox-escape bug to be fully weaponized. This mismatch (CVSS C:H/I:H/A:H vs. vendor Medium + sandbox containment) means the 8.8 likely overstates practical risk for a fully patched, sandboxed deployment. No EPSS score, SSVC decision data, KEV listing, or POC indicator is present in the input, so exploitation likelihood cannot be quantified; per precision rules, status is 'no public exploit identified at time of analysis.' Net: patch promptly given Chrome's ubiquity and the drive-by (UI:R only) nature, but this is not a confirmed in-the-wild priority on the level of a KEV-listed sandbox-escape, and the sandbox boundary is the key mitigating control to verify. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that abuses improper input validation in Chrome's Extensions component; when a victim simply visits the page, the attacker can potentially execute arbitrary code within the renderer sandbox. No authentication is required (PR:N) but user interaction is (UI:R) - the victim must load the attacker-controlled page. No public proof-of-concept is identified in the provided data, and resulting code execution is confined to the sandbox absent a chained escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in the Extensions component of Google Chrome builds earlier than 156.0.8078.47 lets a remote, unauthenticated attacker trigger arbitrary code execution inside the browser sandbox when a victim opens a crafted HTML page. The attack is network-reachable and low-complexity but requires user interaction - the target must navigate to an attacker-controlled or compromised page - and, because the resulting code execution is confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Google rates the flaw Medium under its own Chromium severity scale even though the CVSS 3.1 base score is 8.8; a vendor patch is available in 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - the vendor-released fixed build - via the Stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; confirm the installed version at chrome://version and fully restart the browser so the update actually loads (a restart is required for the patch to take effect). Where auto-update is unreliable, push the build through enterprise software deployment and enforce it with the Chrome Update policy plus a minimum-version policy, accepting that out-of-date clients will otherwise remain reachable through ordinary browsing. Until the update is applied, a compensating control is to block or heavily restrict extensions through enterprise policy (for example an allowlist-only extension policy or ExtensionInstallBlocklist set to '*'), which reduces exposure to the Extensions parsing path at the cost of disabling any extensions users depend on; disabling extensions per-user in chrome://extensions is the lighter-weight, manual equivalent. Because exploitation still requires the victim to load a crafted HTML page, URL filtering and phishing-resistant browsing controls lower the probability of a successful attempt but do not remove the vulnerability, and no mitigation substitutes for reaching 156.0.8078.47.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness is classified as CWE-20 (Improper Input Validation) and lives in Chrome's Extensions subsystem - the component that parses extension manifests, resources, and messages crossing the boundary between web content, the renderer, and privileged browser-side extension handling. Because the entry point is a crafted HTML page rendered in the normal browsing context, the flaw is reachable over the network (AV:N) at low complexity (AC:L) without credentials (PR:N), but the CVSS vector's UI:R reflects that a victim must actually load the malicious page. Successful abuse yields high confidentiality and integrity impact within the renderer's sandbox; the Chromium sandbox remains the containment boundary, so escaping to the operating system is not described by this CVE and would require an independent privilege-escalation bug. Notably, Google's advisory assigns only Medium severity, a useful reminder that the 8.8 CVSS score describes worst-case in-sandbox impact rather than guaranteed host takeover, and that the practical blast radius is shaped by Chromium's site isolation and sandbox architecture.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Drive-by via crafted page gives AV:N/AC:L/PR:N/UI:R; code exec in the renderer yields C/I/A:H within the unchanged sandbox scope (S:U), with no cross-boundary scope change claimed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity input validation flaw in the Extensions component that allows a crafted web page to execute arbitrary code within the browser sandbox. Leadership should care because employees and other users who browse attacker-controlled or compromised sites could be exposed, potentially leading to data loss or further compromise if chained with a sandbox escape; no public exploit identified at time of analysis, and Vendor-released patch: 156.0.8078.47 is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB