EUVD-2026-105622
GHSA-w77x-v6w3-gmq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Accessibility
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Chrome prior to 156.0.8078.47 to load attacker-controlled HTML that exercises the Accessibility component's vulnerable code path, triggering the use-after-free. The key limiting factor is user interaction (UI:R): the target must actively open or navigate to the malicious page. A further significant limit is that successful exploitation yields code execution only inside the renderer sandbox, so full host compromise additionally requires chaining a separate sandbox-escape vulnerability. No authentication is required (PR:N). Accessibility code paths are part of default Chrome; no special non-default configuration is indicated by the description. |
| Impact | Signals are moderately concerning but not top-priority-emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) scores 8.8 High: network-reachable, low complexity, no privileges, but requires user interaction (victim must visit a crafted HTML page) and scope is unchanged - critically, the description confirms code execution is confined 'inside the sandbox', meaning this is a renderer-level RCE that still needs a separate sandbox-escape to compromise the host. Chromium's own labeling of 'Critical' reflects memory-corruption severity, not a full host takeover. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or imminent widespread exploitation at this time. The main risk driver is prevalence rather than exploitation signals: Chrome's enormous install base makes any reliable UAF attractive to attackers who can chain it. Note a nuance to verify: the 'Scope: Unchanged' designation is consistent with the 'inside the sandbox' wording, whereas full browser RCE chains typically require scope change via a sandbox escape - defenders should treat raw '8.8' as the sandboxed-renderer impact only. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Accessibility component when rendered. A victim running an unpatched Chrome (before 156.0.8078.47) simply visits the page, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided data, so practical exploitation currently requires original exploit development plus a chained sandbox escape to affect the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Accessibility component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit was identified at time of analysis. Google rates the Chromium security severity Critical, and affected users should update to 156.0.8078.47.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47. Upgrade Google Chrome to 156.0.8078.47 or later through the stable-channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and relaunch the browser so the new binary is active; verify the version via chrome://version. ChromeOS administrators should apply the corresponding stable-channel update referenced at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html. Because exploitation requires the victim to load attacker-controlled HTML, interim measures include forcing browser restarts through enterprise policy, restricting access to untrusted sites where operationally feasible, and using remote browser isolation for high-risk web content; these reduce exposure but do not fix the underlying use-after-free and may add latency or compatibility friction. No vendor workaround other than updating to the fixed release is identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Accessibility (AX) implementation. Accessibility code builds and maintains the accessibility tree exposed to screen readers and platform accessibility APIs; a crafted HTML page can cause an object to be freed while a stale reference remains, producing memory corruption that may be shaped into code execution in the renderer. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network-delivered content, low complexity, no privileges, required user navigation, and high confidentiality, integrity, and availability impact, while scope is unchanged and the renderer sandbox limits direct host impact. The vendor rates this Chromium security severity Critical, and the issue was reported through Google's Chrome CVE process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user navigation (UI:R); scope unchanged since code runs within the renderer sandbox; high C/I/A for memory-corruption RCE.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity use-after-free flaw in the Accessibility component that can allow code execution inside the browser’s renderer sandbox when a user loads a crafted HTML page. Exploitation requires user interaction and remains sandbox-confined unless chained with a separate sandbox escape, and no public exploit was identified at time of analysis. Leadership should prioritize rapid remediation across Chrome-using endpoints because the affected browser is widely deployed and user browsing remains a common exposure path.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB