EUVD-2026-105754
GHSA-262f-287v-559f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Controls
-
ExecutionCorrupt renderer heap/memory
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 156.0.8078.47 and to load attacker-controlled crafted HTML (UI:R - user interaction such as visiting a malicious or compromised page is mandatory; there is no drive-by-without-visit path). A key LIMITING factor is that arbitrary code execution occurs only 'inside the sandbox' per the vendor - the renderer sandbox contains the impact, so meaningful host compromise additionally requires a separate sandbox-escape vulnerability, which is why Chromium rated this Low. No special non-default configuration is named; the flaw is in the standard Controls component. Chrome's automatic update mechanism also sharply narrows the realistic exposure window. |
| Impact | Signals conflict sharply and must be weighed carefully. The NVD CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this HIGH, implying a network-reachable, unauthenticated, low-complexity flaw needing only a single user interaction. However, the Chromium project itself rated this 'Low' severity, and the description explicitly states code executes 'inside the sandbox' - meaning this is a renderer-contained memory-corruption bug (CWE-119) that does NOT by itself breach Chrome's sandbox boundary and requires chaining with a separate sandbox-escape to achieve host compromise. This gap (NVD HIGH vs vendor LOW) suggests the 8.8 score overstates practical impact for defenders who rely on Chrome's sandbox as a mitigating control. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input; no public exploit identified at time of analysis. Net assessment: patch via normal Chrome auto-update cadence, but this is better characterized as a routine high-CVSS-but-vendor-low-real-risk browser bug than an emergency, absent any exploitation evidence. Verify the sandbox-containment nuance against the vendor advisory before deprioritizing in high-value environments. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption flaw in Chrome's Controls component when a victim visits it. Successful exploitation could execute arbitrary code within the renderer sandbox, though full host compromise would require chaining an additional sandbox-escape bug. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Controls component allows remote, unauthenticated attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Chrome prior to 156.0.8078.47 (UI:R is required). The vendor rates the issue Chromium severity Low because code execution is contained within the sandbox and meaningful host compromise would require a separate sandbox escape, even though the CVSS base score is 8.8; no public exploit was identified at time of analysis and a vendor patch is available.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later; this is a vendor-released patch, and Chrome's automatic update mechanism should deliver it, but administrators should verify via chrome://settings/help or enterprise update policy and restart the browser to complete installation. If immediate upgrade is not possible, reduce exposure by restricting browsing to trusted sites and blocking delivery of untrusted HTML content, understanding that these are temporary compensating controls that do not fix the underlying memory corruption and may reduce user functionality; the sandbox limits host impact but should not be treated as a substitute for patching. Track the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and Chromium issue https://issues.chromium.org/issues/562993085 for update details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within memory buffer bounds in Chromium's Controls component, which handles browser form/UI control rendering and input processing. A crafted HTML page can trigger memory corruption in the renderer process, potentially leading to arbitrary code execution within Chrome's sandbox; because the impact is sandbox-local, Chromium assigned Low severity despite the CVSS vector showing network reachability (AV:N), no privileges required (PR:N), and high confidentiality/integrity/availability impact, with user interaction (UI:R) mandatory. No CPE strings were supplied; the affected technology is the Google Chrome desktop stable channel before 156.0.8078.47, and exploitation does not appear to require non-default configuration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no privileges, but mandatory user interaction (UI:R); renderer code execution yields high C/I/A, and scope stays Unchanged because impact is confined to the sandboxed renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
A high-severity memory-corruption issue affects Google Chrome versions earlier than 156.0.8078.47 and could let a crafted webpage run code inside the browser's renderer sandbox, though the vendor rates the practical risk lower because that code remains isolated from the host. No public exploit identified at time of analysis, and the exposure is mainly to organizations with large, unpatched Chrome fleets; leadership should care because browser compromise can affect workforce productivity and trust even when sandboxing limits blast radius.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB