EUVD-2026-105449
GHSA-w7wf-2c8p-rxrg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in GPU process
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code inside GPU sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit or render an attacker-controlled crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) that exercises the GPU component - this user-interaction requirement (UI:R) is the primary limiting factor. No authentication is required (PR:N) and the default browser configuration is sufficient; no special feature toggle is named in the description. The key impact limiter is that code execution is confined to the GPU process sandbox (S:U): absent a chained sandbox-escape vulnerability, the attacker does not automatically gain host-level code execution. |
| Impact | This is a credible, high-priority patching item but not a drop-everything emergency on the available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated bug that only requires a victim to view a crafted HTML page - a classic drive-by browser profile - and Chromium rated the underlying flaw 'High'. However, the description is explicit that code execution occurs 'inside the sandbox' and the scope is Unchanged (S:U), meaning this UAF yields attacker code in the sandboxed GPU process rather than full host compromise; weaponized real-world RCE on the OS would require chaining a separate sandbox-escape, which tempers the practical impact of the 8.8 score. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified: there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Denial Of Service' tag is consistent with UAF-induced crashes but the primary stated impact is in-sandbox code execution. Net: treat as a routine-but-prompt Chrome update given ubiquity and the drive-by vector, while noting that EPSS/KEV data is absent and the sandbox boundary limits standalone severity. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious content that triggers the use-after-free in Chrome's GPU component when rendered. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) simply visits the page, and the attacker gains arbitrary code execution within the GPU process sandbox. No public exploit code was identified in the provided data, and a separate sandbox escape would be needed to reach the underlying OS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Chrome's GPU process lets remote attackers achieve code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires user interaction (UI:R) with no authentication needed (PR:N), though the code execution is confined to the GPU process sandbox (S:U) unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
RemediationAI
Upgrade Google Chrome (and ChromeOS, which received a parallel stable-channel update) to 156.0.8078.47 or later; confirm the version via chrome://settings/help or the ChromeOS version screen and allow the browser to restart to complete the update. Per the vendor, a patch is available, so no compensating control should be treated as a substitute - but where immediate fleet upgrade is not possible, reducing exposure means restricting browsing to trusted sites and blocking untrusted HTML content at the proxy or email gateway, which lowers the chance of a victim loading a crafted page that exercises the GPU path. Organizations that rely on GPU acceleration for kiosks or remote-desktop workloads should prioritize those endpoints, since a chained sandbox escape would be the path from the GPU-process sandbox to host compromise. Track the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html for any updated version guidance, and note that Chromium-derived browsers must ship their own 156.0.8078.47-equivalent builds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in Chrome's GPU component, the process that handles graphics rendering, compositing, and GPU-accelerated drawing via Chromium's graphics stack. A use-after-free occurs when the GPU process frees an object but continues to reference it, so a crafted HTML page that triggers the right rendering sequence can cause the dangling pointer to be reused - allowing an attacker to influence memory contents and redirect execution flow. Because the flaw is reachable from web content and the GPU process processes rendered pages, a remote, unauthenticated attacker can trigger it simply by getting a victim to visit a malicious page. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects high confidentiality and integrity impact, but with S:U the impact is bounded to the GPU process sandbox, so host compromise requires chaining with a second, sandbox-escape vulnerability. The CPE and EUVD data identify Chrome versions below 156.0.8078.47 as affected, cross-referenced by Google's stable-channel desktop and ChromeOS advisories.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Drive-by via crafted page gives AV:N/AC:L/PR:N, victim must load the page (UI:R); in-sandbox arbitrary code execution yields C/I/A:H with scope unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds before 156.0.8078.47 carry a high-severity flaw that can allow a crafted web page to execute code inside the browser's GPU process sandbox after user interaction. Because Chrome is widely deployed, unpatched endpoints create broad organizational exposure, although no public exploit or confirmed active exploitation was identified at time of analysis and the sandbox limits standalone impact. Leadership should prioritize rapid update verification across the browser fleet rather than incident response at this time.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB