EUVD-2026-105460
GHSA-4q8q-vgfq-wrw3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious media content
-
ExploitTrigger out-of-bounds read in Media component
-
ExecutionLeak adjacent sandbox memory
-
ImpactExfiltrate disclosed data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Chrome's Media component to process attacker-controlled content - i.e., the user must navigate to or load a crafted HTML page containing the malicious media (the UI:R interaction requirement). No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected since media handling is a core built-in feature. The primary limiting factors are: (1) mandatory user interaction (visiting the page), (2) the disclosure is confined to memory within the renderer sandbox, meaning a sandbox escape would be needed to reach the host, and (3) affected builds are only those prior to 156.0.8078.47, so auto-updated browsers are quickly remediated. |
| Impact | This is a genuine but moderate-priority issue. All signals are internally consistent: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a remote, low-complexity, unauthenticated (PR:N) attack that requires user interaction (UI:R) - the victim must visit a crafted HTML page. The impact is confined to confidentiality (C:H) with no integrity or availability effect, matching CWE-125 (out-of-bounds read) and the description's note that the read occurs 'inside the sandbox.' EPSS is low at 0.23% (13th percentile), there is no CISA KEV listing, and no public POC is referenced - exploitation status is 'no public exploit identified at time of analysis.' Chromium itself rated this 'High' severity, which reflects the memory-disclosure potential within a ubiquitously deployed browser rather than confirmed exploitation. The one point to verify: the C:H rating paired with 'read memory inside the sandbox' suggests the leak is bounded by the renderer sandbox and would typically need to be chained with a sandbox-escape bug to reach high-value host data - so standalone real-world impact is likely lower than the C:H metric implies. Net: patch on normal cadence; not an emergency given low EPSS, no KEV, and the UI:R requirement. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted media content and lures a victim running a vulnerable Chrome build to visit it. When Chrome's Media component processes the content, an out-of-bounds read leaks adjacent renderer memory, which the attacker can exfiltrate to defeat ASLR or harvest sensitive in-process data. No public exploit code is identified; successful attack requires the victim to actively load the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Out-of-bounds read in Google Chrome's Media component (fixed in 156.0.8078.47) lets a remote attacker read memory inside the renderer sandbox by convincing a user to open a crafted HTML page that feeds malformed media data to Chrome's parsing pipeline. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), and the information leak is bounded by the renderer sandbox, so a separate sandbox escape would be required to reach host memory; confidentiality impact is rated High while integrity and availability are unaffected. No public exploit code or active exploitation was identified at time of analysis (EPSS 0.23%, 13th percentile), and the vendor has released a fixed build, so exposure is largely limited to browsers that have not yet auto-updated.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later; the fix is distributed through the standard Chrome stable-channel release described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, with the corresponding ChromeOS build covered at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html. Confirm version compliance via chrome://version or your endpoint management console, and note that browsers left on older milestones (for example, fleets using update-deferral policies or pinned builds) will not receive the fix automatically - shorten or temporarily lift those deferrals until 156.0.8078.47 is deployed, accepting the small operational risk that early-update regressions may affect line-of-business web apps. No configuration toggle disables the Media component outright, so compensating controls are limited: restrict browsing to allowlisted sites via enterprise URL filtering (trade-off: breaks general web use and is bypassable by redirects), and rely on the renderer sandbox plus site isolation as the containment boundary that keeps the out-of-bounds read from reaching host memory (trade-off: containment, not prevention - a chained sandbox escape would still be impactful). Given the mandatory user interaction (UI:R) and the absence of identified public exploit code or KEV listing, patching on the normal update cadence is proportionate, but prioritize any user population that routinely opens untrusted media-heavy pages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-125 out-of-bounds read in Chrome's Media subsystem, the layer responsible for demuxing and decoding container formats and audio/video streams (e.g. MP4/WebM/MP3 pipelines) inside the renderer process. Parsing attacker-supplied media structures without sufficient bounds validation causes reads past the end of an allocated buffer, and the leaked bytes can be surfaced to the attacker through crafted page scripting, making this an information-disclosure primitive rather than memory corruption. Because media playback is a core, always-enabled browser feature, no extensions or special configuration are needed for a victim to reach the vulnerable code path; the only prerequisite is that the page be loaded. The sandbox is the key containment boundary here: data disclosed is confined to the renderer's address space, so real-world impact depends on pairing this read with a separate sandbox-escape vulnerability. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms a network-delivered, unauthenticated attack that is gated solely by user interaction, which is consistent with the assessed exploitation conditions. Google rates Chromium security severity High; the issue is tracked as Chromium bug 568831768 and was credited via the chrome-cve-admin reporting channel.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page with no privileges (AV:N/PR:N) but requires the victim to load it (UI:R); an out-of-bounds read leaks memory (C:H) with no write or crash impact (I:N/A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB