EUVD-2026-105753
GHSA-2r3p-gpf4-7w5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Chromoting
-
ExecutionRead adjacent memory within sandbox
-
ImpactExfiltrate leaked in-process data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open or navigate to a crafted HTML page in a vulnerable Google Chrome build (any version prior to 156.0.8078.47) - user interaction is mandatory (UI:R), so there is no drive-by-without-browsing path. Exploitation involves the Chromoting (Chrome Remote Desktop) component. The outcome is strictly limited: the attacker can read memory CONTAINED WITHIN the sandbox (C:H, but I:N/A:N) - the flaw as described does not grant sandbox escape, memory writes, code execution, or availability impact, which materially limits real-world risk. No authentication is required (PR:N), and default configurations are affected. |
| Impact | This is a moderate-severity, low-priority issue despite a CVSS base score of 6.5. The signals are consistent and point AWAY from urgent action: EPSS is 0.22% (11th percentile), indicating very low predicted exploitation likelihood; the vulnerability is NOT in CISA KEV; and no public exploit code was identified in the provided data. Google/Chromium themselves rated the security severity as 'Low'. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores confidentiality as High, but the description narrows the real impact substantially: the attacker can only 'read memory inside the sandbox' - there is no integrity or availability impact, no sandbox escape, and no code execution claimed. This tension between the CVSS C:H rating and the sandbox-confined read described by the vendor is worth noting: the practical confidentiality impact is likely lower than C:H implies, since the disclosure is bounded by the sandbox. Net assessment: patch via normal Chrome auto-update cadence; this does not warrant emergency out-of-band response. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the Chromoting (Chrome Remote Desktop) memory-corruption flaw when rendered. A victim running a vulnerable Chrome build visits the page, and the attacker reads memory contents confined to the sandbox, potentially leaking sensitive in-process data. No public exploit code was identified at time of analysis, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory disclosure in Google Chrome's Chromoting component allows a remote, unauthenticated attacker to read memory within the browser sandbox when a victim opens a crafted HTML page. The issue affects Chrome versions prior to 156.0.8078.47 and requires user interaction; the assessed impact is confidentiality-only, with no sandbox escape, code execution, integrity, or availability effect. EPSS is low at 0.22%, no public exploit has been identified at time of analysis, and a vendor patch is available.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47. Upgrade to 156.0.8078.47 or later through the stable-channel update and verify the installed version at chrome://version; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. If upgrading cannot be completed immediately, disable or block the Chromoting/Chrome Remote Desktop component through enterprise policy or component controls where feasible; this reduces exposure to the crafted-HTML attack path but breaks remote-desktop functionality for affected users. Because exploitation requires user interaction, restricting high-risk users from navigating to untrusted pages may reduce exposure, but it should not be treated as a primary control. Track Chromium issue 562978160 for technical details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chromoting is the Chrome Remote Desktop component embedded in Google Chrome, and the flaw is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer. A crafted HTML page can trigger memory corruption in this component that results in an out-of-bounds read inside the renderer sandbox, rather than a write primitive or sandbox escape. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U with confidentiality-only impact, meaning the attacker must convince a user to load a page and can read only data already reachable within the sandbox; there is no code execution, integrity impact, or availability impact. The Chromium security severity is Low, and the public Chromium issue 562978160 plus the Chrome stable-channel advisory are the vendor references.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable crafted page with no auth (AV:N/PR:N) but required browsing (UI:R); impact is a sandbox-confined memory read, so C:L with no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB