EUVD-2026-105521
GHSA-qpgj-pmxf-378x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Chrome API
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled web content in Chrome (UI:R / user interaction, confirmed by CVSS vector), so it is not a zero-click flaw - a user must navigate to or render the crafted HTML page. Any Chrome build prior to 156.0.8078.47 on the desktop stable channel is affected in default configuration; no special feature flag or non-default setting is called out in the description. The key limiting factor is scope: code execution is confined 'inside the sandbox' (S:U, no scope change), so without a separate sandbox-escape or privilege-escalation bug the attacker cannot reach the host OS, and Chrome's automatic update mechanism rapidly reduces the exposed population. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a user open a crafted page - the classic browser drive-by profile. However, this high score is in tension with two mitigating signals: Google rated the Chromium security severity as 'Medium', and the description explicitly limits code execution to 'inside the sandbox', meaning there is no accompanying sandbox escape and impact is confined to the renderer process rather than the host OS. Realistically this is a one-bug-of-a-chain issue: valuable to attackers only when paired with a separate sandbox-escape vulnerability. No EPSS score, no KEV listing, no SSVC decision data, and no POC indicator were supplied, so exploitation likelihood cannot be quantified from the input - exploitation status is therefore 'no public exploit identified at time of analysis'. Net assessment: patch on the normal Chrome auto-update cadence; this is a genuine memory-corruption bug worth fixing but is not, on the available evidence, an emergency on par with a sandbox-escaping or actively-exploited Chrome zero-day. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing JavaScript/HTML that drives a specific Chrome API into a use-after-free state, then lures a victim to visit it (malvertising, phishing link, or watering-hole). Triggering the freed-object reuse lets the attacker execute arbitrary code within the renderer sandbox, which on its own yields access to renderer-held data and can serve as the first stage of a longer exploit chain. No public proof-of-concept was indicated in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's API layer prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (8.8) confirms network reachability and no privileges required, but exploitation is not zero-click: it requires user interaction to render the crafted page, and the impact is scope-limited to Chrome's sandbox (S:U). Google has released a fixed build, and no public exploit code was identified at time of analysis.
RemediationAI
Google has released Chrome 156.0.8078.47, which fixes CVE-2026-113275; update Chrome through the built-in updater and relaunch the browser, and verify the installed version via chrome://settings/help or enterprise version reporting. The vendor advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium bug is at https://issues.chromium.org/issues/502040109. No vendor-documented workaround is provided; organizations that cannot immediately update can reduce exposure by restricting high-risk browsing to trusted sites or isolated environments, but this is disruptive, does not fix the underlying flaw, and leaves users exposed if they render attacker-controlled content. Chrome's sandbox limits post-exploitation impact to the sandboxed context unless the attacker chains a separate sandbox-escape vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, a memory-corruption class in which an object is freed but a dangling pointer is later dereferenced. The vulnerable component is described as Chrome's API surface; the exact API is not named in the supplied data. A crafted HTML page triggers the affected API path, causing memory corruption that can be shaped into arbitrary code execution within the renderer/API sandbox context. The CVSS vector confirms PR:N (no authentication), UI:R (victim must open the crafted page), and S:U (no scope change), so code execution remains inside Chrome's sandbox unless chained with a separate sandbox escape. Affected builds are Chrome desktop stable versions prior to 156.0.8078.47; EUVD lists the affected range as Chrome 156.0.8078.47 <156.0.8078.47, meaning versions below the fixed build. No CPE strings were supplied in the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but mandatory victim interaction (UI:R); sandboxed renderer code execution keeps scope unchanged (S:U) while compromising renderer confidentiality, integrity and availability.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity memory corruption flaw that could allow a remote attacker to run malicious code within the browser sandbox if a user visits a crafted webpage. Because Chrome is widely deployed across the organization, successful exploitation could lead to unauthorized code execution on employee endpoints, though it requires user interaction and remains confined to the browser sandbox. No public exploit identified at time of analysis, but leadership should prioritize patching to reduce exposure to targeted attacks and maintain endpoint integrity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB