EUVD-2026-105630
GHSA-xcfr-cxqm-gxp8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Views
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a macOS user running Google Chrome prior to 156.0.8078.47 to load attacker-controlled HTML content in the browser (UI:R user interaction). No authentication or privileges are needed (PR:N), and default configurations are affected. The key LIMITING factors are: (1) resulting code execution is confined to the renderer sandbox (S:U), so a separate sandbox-escape vulnerability is needed for host compromise; (2) the flaw is platform-specific to macOS builds and does not apply to Windows/Linux Chrome; and (3) the user must actively navigate to the malicious page. |
| Impact | This is a CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a remote, low-complexity, unauthenticated vulnerability requiring only that a user open a crafted HTML page. However, several signals temper the raw CVSS: Google/Chromium rated the underlying issue 'Medium' severity, and the description explicitly states code execution is 'inside the sandbox' - meaning the scope is Unchanged (S:U) and this is NOT a full sandbox escape or host compromise on its own. It would realistically need to be chained with a separate sandbox-escape bug to achieve meaningful system-level impact. No EPSS score, KEV listing, or POC availability was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Denial Of Service' tag is plausible given use-after-free (CWE-416) can crash the renderer, but the primary concern is renderer-constrained code execution. Net: a legitimate patch-worthy memory-corruption bug in a ubiquitous product, but its real-world priority is lower than the 8.8 suggests because exploitation is sandbox-confined, requires user interaction, and affects only macOS Chrome builds prior to 156.0.8078.47. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted content that triggers the use-after-free in Chrome's Views component when rendered. A macOS victim running a vulnerable Chrome version visits the page (UI:R), and the attacker achieves code execution confined to the renderer sandbox. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Arbitrary code execution inside the Chrome renderer sandbox on macOS is possible with Google Chrome versions prior to 156.0.8078.47 when a user opens a crafted HTML page. The flaw is a use-after-free in Views rated CVSS 3.1 8.8 (High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requiring user interaction but no authentication; code execution is confined to the renderer unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
RemediationAI
Upgrade Google Chrome on macOS to version 156.0.8078.47 or later; the vendor has released a patch, and Chrome's auto-update mechanism or a manual download from Google can apply it, with version verification through chrome://version. Enterprise administrators should enforce the fixed version through browser update policies, accepting that forced relaunches or update enforcement may interrupt active sessions. If immediate upgrade is not possible, restrict use of the unpatched macOS Chrome build for untrusted HTML content and consider isolating risky browsing to a separately managed browser profile or virtualized environment, recognizing that domain-blocking is reactive and does not address the underlying memory corruption. Advisory references: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://issues.chromium.org/issues/553160293.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-113282 is a CWE-416 use-after-free in Chromium's Views UI framework, which underlies Google Chrome's browser UI and related rendering paths. The defect involves memory lifecycle mismanagement in which an object can be freed and later dereferenced while processing attacker-controlled HTML, allowing memory corruption that may be leveraged for arbitrary code execution inside the renderer sandbox. The issue is specific to macOS Chrome builds prior to 156.0.8078.47 and is remotely reachable through web content with user interaction (UI:R) but no privileges (PR:N); the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects high confidentiality, integrity, and availability impact within the renderer scope, not host-level compromise without a sandbox escape. No CPE strings were supplied in the available data.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N), no privileges (PR:N) but requires user to open the page (UI:R); scope stays Unchanged because code runs within the sandbox, with high renderer-level C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Articles & Coverage 1
Executive ViewAI
Google Chrome on macOS prior to version 156.0.8078.47 contains a use-after-free memory flaw in the Views component that lets a crafted web page run arbitrary code inside the browser's renderer sandbox. Any Mac user who browses to attacker-controlled content with an unpatched browser is exposed, making routine web activity the delivery path and turning the installed browser fleet into a broad, low-friction attack surface across the organization. Because the code execution is contained by the renderer sandbox unless combined with a separate sandbox-escape flaw, the near-term risk to endpoints is elevated but not yet a full system compromise; leadership should treat this as a priority patch-cycle item rather than an emergency, given no public exploit code exists.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB