EUVD-2026-105749
GHSA-wxhm-98hq-gq88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger DevTools memory corruption
-
ExploitCorrupt memory / control execution
-
ExecutionExecute arbitrary code in sandbox
-
ImpactContained in-sandbox compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to load a crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) that triggers the memory-corruption flaw in DevTools (UI:R - user interaction is mandatory). Resulting code execution is confined to the renderer sandbox: per the vendor description it runs 'inside the sandbox,' so a separate sandbox-escape vulnerability is required for host-level impact. Limiting factors: mandatory user navigation to attacker content, sandbox containment of the payload, and the need for the affected pre-156.0.8078.47 version. |
| Impact | Signals conflict sharply here. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 (High), implying remote code execution with full confidentiality, integrity, and availability loss. However, the description explicitly states the code executes 'inside the sandbox,' and Google/Chromium rated this security severity 'Low.' Sandboxed execution means no host compromise occurs without a separate sandbox-escape bug, so the C:H/I:H/A:H impact rating overstates real-world consequence - the vendor's 'Low' rating and the sandbox containment point to materially lower risk than the 8.8 suggests. No EPSS score, KEV listing, or POC is present in the input: exploitation status is no public exploit identified at time of analysis, and there is no evidence of active exploitation. UI:R (user must visit a crafted page) further gates exploitation. Net: this is a high-CVSS-but-low-real-risk issue by itself - a patch-in-routine-cycle item, not an emergency - unless chained with a sandbox escape. Verify the impact scope with Google, as the NVD-style vector and the Chromium 'Low' rating disagree. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a Chrome user (versions prior to 156.0.8078.47) to visit it, triggering a memory corruption condition in DevTools that lets the attacker execute code within the renderer sandbox. Because UI:R applies, success depends on the victim loading the page; impact is confined to the sandbox absent a separate escape. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Code execution inside the renderer sandbox is possible through memory corruption in Google Chrome's DevTools before 156.0.8078.47, triggered when an unauthenticated remote attacker convinces a victim to load a crafted HTML page. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, reflecting mandatory user interaction and sandbox containment, which is lower than the NVD-style 8.8 score. No public exploit identified at time of analysis, and Google has released a fixed build.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47. Upgrade to 156.0.8078.47 or later and verify the version via chrome://version; allow Chrome's auto-update to complete or restart the browser after updating, per the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. If immediate upgrade is not possible, reduce exposure by disabling Developer Tools through the DeveloperToolsAvailability enterprise policy and by restricting browsing to trusted content; disabling DevTools can break developer and debugging workflows, and it does not replace the patch because the underlying renderer memory-corruption flaw may still be reachable through other paths. Treat the Chrome sandbox as a containment layer, not a fix; a separate sandbox escape would be needed for host compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Google Chrome's DevTools is the browser's built-in developer tooling; the flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer, reachable through crafted HTML. Because the vulnerable component runs in the renderer, the potential impact is code execution inside the sandbox rather than direct host compromise; OS-level access would require chaining a separate sandbox-escape vulnerability. The independent assessment's vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) treats confidentiality, integrity, and availability impact as low with scope unchanged, which is consistent with sandbox confinement, while the supplied NVD-style vector claims high impact (C:H/I:H/A:H). Chromium rated the issue security severity Low, and EUVD identifies affected versions only as Chrome builds earlier than 156.0.8078.47; no CPE mappings were supplied.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs user interaction (UI:R, PR:N); impact downgraded to Low across C/I/A because execution is contained within the sandbox, matching the vendor's 'Low' severity.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome's DevTools component contains a memory corruption flaw that could allow code execution within the browser's renderer sandbox when a user loads a crafted HTML page, affecting employees using unpatched Chrome builds. The risk is constrained by required user interaction and sandbox containment, and no public exploit has been identified, but a browser compromise could still disrupt productivity and expose sensitive data. Leadership should treat this as a fleet-wide patch-management priority and verify that the fixed Chrome build is deployed across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB