EUVD-2026-105501
GHSA-p6pq-93gv-f6j2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malformed media via HTML
-
ExecutionTrigger memory corruption in Media component
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to get a victim using an unpatched Chrome build prior to 156.0.8078.47 to load a crafted HTML page containing malicious media content (UI:R - user must open the page); no authentication or special privileges are needed (PR:N). Key LIMITING factors: the attacker must induce user interaction (visiting/opening the page), and the resulting code execution is confined to the renderer sandbox ('inside the sandbox'), so full system compromise additionally requires a separate sandbox-escape vulnerability. There is no indication a non-default configuration is needed; any default Chrome install before the fixed version that renders the malicious media is affected. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes network-reachable, low-complexity, unauthenticated code execution requiring only that a user open a crafted HTML page - a classic drive-by browser profile. However, Google's own Chromium security team rated this only MEDIUM, and the description explicitly scopes impact to 'inside the sandbox,' meaning no renderer-sandbox escape is claimed; the S:U (scope unchanged) in the vector is consistent with that containment. This discrepancy - 8.8/HIGH numeric score versus vendor MEDIUM rating - should be read as the CVSS formula over-weighting a bug whose real blast radius is bounded by the Chromium sandbox. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was referenced, so this is: no public exploit identified at time of analysis. No SSVC decision data was supplied. Net: a legitimate memory-corruption RCE worth patching on the normal browser-update cadence, but absent evidence of exploitation or a sandbox-escape chain, it is not an emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malformed media content and lures a victim running an unpatched Chrome (before 156.0.8078.47) to visit it. The crafted media triggers memory corruption in Chrome's Media component, allowing the attacker to execute arbitrary code within the renderer sandbox. No public exploit code was identified; full host compromise would additionally require a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's media handling before version 156.0.8078.47 can let a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 with user interaction required, and successful exploitation is confined to the sandbox, so full host compromise would require an additional sandbox escape. No CISA KEV listing or public exploit was identified at time of analysis, and no public exploit identified at time of analysis.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later; the vendor-released patch is available and documented in the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Enable Chrome automatic updates, verify the installed version, and restart the browser to activate the update. If immediate upgrade is not possible, reduce exposure by restricting browsing to trusted sites, blocking untrusted HTML content through enterprise web filtering, and keeping the renderer sandbox enabled, recognizing that these are compensating controls rather than fixes and that the sandbox only limits post-exploitation impact. No vendor workaround beyond updating was identified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-113257 is a CWE-119 memory-corruption flaw in Chrome's Media component, meaning improper bounds checking on memory buffers can corrupt process memory while parsing or rendering media content. The attack vector is network-based and requires the victim to load a crafted HTML page (UI:R), but no privileges or authentication are needed (PR:N). Because code execution is described as occurring inside the sandbox, the renderer's isolation limits the immediate blast radius; achieving operating-system-level compromise would require a separate sandbox-escape vulnerability. Affected builds are Chrome versions prior to 156.0.8078.47, with the flaw residing in the Chromium codebase and its media handling paths.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted HTML page is network-reachable (AV:N) and unauthenticated (PR:N) but needs the user to open it (UI:R); impact stays within the renderer so scope is unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity memory-corruption flaw in media handling that could let a crafted webpage execute code within the browser's renderer sandbox, requiring user interaction and an additional sandbox escape for full host compromise. Because Chrome is widely used for core business activity, unpatched endpoints create avoidable exposure even though no public exploit was identified at time of analysis. Leadership should prioritize rapid browser patching and verify version compliance across managed devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB