EUVD-2026-105623
GHSA-mvrm-gj2p-jw68
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious WebRTC payload
-
ExecutionTrigger memory corruption in WebRTC (CWE-119)
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Google Chrome build prior to 156.0.8078.47 and to load a crafted HTML page under attacker control (UI:R - user interaction via navigation is mandatory). The flaw resides in Chrome's WebRTC component, so the crafted page must exercise WebRTC processing to reach the vulnerable memory-handling code. No authentication or pre-existing privileges are needed (PR:N). Key limiting factor: per the vendor, resulting code execution is confined to the renderer sandbox, so full system compromise additionally requires a separate sandbox-escape vulnerability; no non-default configuration is otherwise required since WebRTC is a standard browser capability. |
| Impact | This is a genuine high-priority issue, though not a top-tier emergency based on the signals available. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - a trivial bar for a web browser. Google/Chromium internally rated the severity Critical, and the memory-corruption class (CWE-119) in WebRTC is a well-known RCE primitive. Tempering this: the vendor states code execution occurs INSIDE the sandbox (scope unchanged, S:U), so a successful exploit alone does not yield host compromise without a separate sandbox-escape chain. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or widespread weaponization at this time. The practical risk is therefore 'patch promptly' rather than 'emergency zero-day': ubiquitous attack surface and easy trigger conditions, but exploitation is currently theoretical in the available data and impact is sandbox-confined absent an additional escape. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious WebRTC content and lures a Chrome user to visit it (via phishing link, malvertising, or a watering-hole site). When the page loads, the crafted WebRTC data triggers the memory-corruption bug and allows the attacker to potentially execute arbitrary code within the Chrome renderer sandbox. No public exploit code was identified in the provided data; exploitation requires user interaction (visiting the page) but no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's WebRTC component, affecting builds prior to 156.0.8078.47, allows a remote attacker to corrupt memory and potentially execute arbitrary code inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must navigate to attacker-controlled content that exercises WebRTC processing - and any resulting code execution is confined to the renderer sandbox, so full system compromise would additionally require a separate sandbox-escape flaw. Google rates the issue Chromium security severity Critical and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch-now item rather than a top-tier emergency.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - this is the exact vendor-released fix documented in the stable-channel desktop advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html - and complete a full browser restart, since Chrome applies updates only after all processes (including background/extension processes) are restarted; verify the version on chrome://version. ChromeOS-managed devices should be updated per http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html, and organizations should enforce a minimum-version policy through their update management tooling while tracking the Chromium issue for regression details. If immediate patching is not possible, the practical compensating control is to reduce exposure to attacker-controlled WebRTC content: force all rendering through a remote/isolated browsing tier, enforce strict URL allowlisting or blocking of uncategorized sites for high-risk users, and use an extension or enterprise WebRTC policy to disable or restrict WebRTC media/peer-connection capabilities - accepting the trade-off that this breaks legitimate video-conferencing and real-time collaboration apps and may not fully cover all internal WebRTC paths. Keep the Chromium renderer sandbox enabled and avoid running with --no-sandbox, since the sandbox is the primary limiter of this bug's impact (code execution is confined to the renderer without a chained sandbox escape). Because no public exploit code or confirmed active exploitation was identified at time of analysis, standard patch-cycle urgency applies, but the Critical severity rating and WebRTC's default-on status justify prioritizing this ahead of routine updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and sits in Chrome's WebRTC implementation - the real-time audio/video and peer-to-peer data-channel stack that handles ICE negotiation, DTLS/SRTP media transport, SDP parsing, and codec processing from web content. A crafted HTML/JavaScript page triggers WebRTC-related parsing or media handling that writes or reads outside intended buffer boundaries, producing memory corruption that can be shaped into controlled execution flow. Because the vulnerable code runs in the renderer process, the Chromium multi-process sandbox constrains the immediate blast radius; breaking out to the OS requires chaining a second, independent sandbox-escape vulnerability. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network-reachable, low-complexity exploitation with no privileges required but mandatory user interaction, and high confidentiality/integrity/availability impact on the affected component only (scope unchanged). Affected builds are Google Chrome releases earlier than 156.0.8078.47, as reflected in the EUVD version data; Chromium-derived browsers that rebase on the same upstream milestone inherit the underlying defect until they ship the corresponding fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a crafted page with low complexity and no auth (AV:N/AC:L/PR:N), but victim navigation is required (UI:R); code runs within the sandbox so scope is unchanged (S:U) with high renderer-level impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity WebRTC memory-corruption flaw that could allow an attacker to run code inside the browser's renderer sandbox after a user visits crafted content. The vendor has released a patch, and no public exploit was identified at time of analysis, but Chrome's broad deployment means unpatched endpoints remain a priority exposure for leadership attention.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB