EUVD-2026-105591
GHSA-r9pw-39v2-4fpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger out-of-bounds read in Installer component
-
ExecutionLeak adjacent memory within sandbox
-
ImpactExfiltrate disclosed data to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) on macOS - this mandatory user interaction (UI:R) is the primary limiting factor. The flaw is platform-specific to the macOS build and to the Installer component. No authentication or prior privileges are needed (PR:N), and default configurations are affected, but the disclosed data is confined to memory inside the sandbox, limiting the value of what can be read without a chained sandbox-escape primitive. |
| Impact | This is a genuinely medium-tier issue, not a high-CVSS-masquerading-as-critical case, and the signals are mostly consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction - the victim must open a crafted HTML page - which caps real-world severity. The single C:H impact (I:N/A:N) reflects an information-disclosure-only bug; critically, the description scopes the leak to memory 'inside the sandbox,' meaning this is a contained read rather than a sandbox escape or RCE, so the C:H rating arguably overstates impact (see assessed vector below). Supporting signals align with a lower priority: EPSS is 0.23% (13th percentile), the CVE is NOT in CISA KEV, and no public exploit is identified. Google/Chromium themselves rated this 'Medium.' There is no SSVC decision data in the input. Net: a real but modest-priority browser bug - patch in normal cycle. Note the description text reads 'on on Mac' (a typo) and the EUVD affected-version string 'Chrome 156.0.8078.47 <156.0.8078.47' is malformed/self-contradictory; the intended meaning is clearly 'versions prior to 156.0.8078.47,' but this should be verified against the vendor advisory. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers an out-of-bounds read in Chrome's Installer component on macOS. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, and the attacker's JavaScript potentially reads adjacent process memory confined within the renderer sandbox, possibly aiding further exploitation or leaking in-process data. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Chrome Installer on macOS before 156.0.8078.47 contains an out-of-bounds read that can be triggered when a victim opens a crafted HTML page, potentially exposing memory inside the browser sandbox. Exploitation requires user interaction and no privileges, but the independent assessment limits confidentiality impact to Low because readable data remains inside the sandbox and no sandbox escape is demonstrated. No public exploit identified at time of analysis and no CISA KEV entry appears in the supplied data; EPSS is 0.23% (13th percentile) and the vendor has released Chrome 156.0.8078.47.
RemediationAI
Upgrade Google Chrome on macOS to version 156.0.8078.47 or later; this is the vendor-released patch version, and the advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. After updating, restart Chrome and verify the installed version via chrome://version. If the update cannot be deployed immediately, restrict use of vulnerable Chrome builds for untrusted web content and route browsing through a patched alternative browser, recognizing that this shifts rather than removes the risk; no specific feature-disable workaround is documented in the supplied references. Managed environments can enforce the minimum version through browser update policies or software distribution tooling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an out-of-bounds read (CWE-125), a memory-safety class in which code reads beyond the intended bounds of a buffer because bounds validation is missing or insufficient. In this case the affected component is the Chrome Installer on macOS, and the supplied data identifies a crafted HTML page as the trigger. No CPE strings are provided; EUVD scopes the affected builds to Chrome 156.0.8078.47 <156.0.8078.47, meaning versions earlier than 156.0.8078.47. The supplied NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, while the independent assessment uses AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N; both agree on network reachability, low complexity, no privileges, required user interaction, unchanged scope, and no integrity or availability impact, but the independent assessment lowers confidentiality to Low. Because the disclosed memory is inside the sandbox, higher-impact use would require chaining with a separate sandbox-escape primitive; the tags buffer overflow and information disclosure are consistent with a read-only memory-safety fault rather than code execution on their own.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page with no auth but mandatory user interaction; confidentiality set to Low because the out-of-bounds read is confined inside the sandbox, with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB