EUVD-2026-105455
GHSA-4r99-mwcj-pm9g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious script to Turbolev component
-
ExploitTrigger use-after-free (CWE-416)
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-crafted HTML page in a vulnerable Google Chrome build earlier than 156.0.8078.47 (UI:R), affecting default configurations with no special feature flag or non-default setting indicated. The key limiting factor is this mandatory user interaction (visiting/rendering the page) and the fact that successful code execution is confined to the renderer sandbox (scope Unchanged) - achieving host compromise would require chaining an additional sandbox-escape vulnerability. No authentication is needed (PR:N). |
| Impact | This is a genuine high-priority issue despite the absence of some signals. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw (CWE-416 use-after-free) that only requires a victim to open a crafted HTML page. Google/Chromium rated it 'High', and a vendor patch is already available, which is the strongest confirmed signal here. However, several standard exploitation signals are MISSING from the input: no EPSS probability, no CISA KEV listing, and no POC indicator are provided, so this reads as 'no public exploit identified at time of analysis' rather than confirmed active exploitation. A critical nuance: the description states code execution occurs 'inside the sandbox' and the CVSS scope is Unchanged (S:U), meaning this alone yields renderer-process compromise, NOT full host takeover - a separate sandbox-escape chain would be needed for that, which tempers real-world impact relative to the raw 8.8. Chrome browser bugs of this class are historically attractive to attackers and frequently weaponized after patch disclosure, so prompt patching is warranted, but at analysis time there is no evidence of in-the-wild use. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the Turbolev use-after-free when rendered. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) is lured to the page via phishing, malvertising, or a watering-hole site, and the freed object is reclaimed with attacker-controlled data to achieve arbitrary code execution within the renderer sandbox. No public exploit is identified in the provided data, and resulting code execution is confined to the sandbox unless chained with a separate escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Turbolev component affects versions prior to 156.0.8078.47 and lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (the victim must visit or render the malicious page), and successful code execution is confined to the sandbox; host compromise would require chaining a separate sandbox-escape flaw. Google rates this High severity (CVSS 8.8), and no public exploit was identified at time of analysis, though a vendor patch is available.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later, then restart the browser so the new build takes effect; verify the installed version from chrome://settings/help. ChromeOS users should apply the corresponding stable-channel update described at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html, and desktop users should follow the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Enable automatic browser updates and enforce a minimum-version policy through enterprise management to prevent regression. If immediate patching is not possible, reduce exposure by limiting Chrome use for untrusted web content and routing risky browsing through browser isolation or an alternative browser, recognizing that this degrades user experience; keep the renderer sandbox and site isolation enabled, since the vulnerability's impact is confined to the sandbox and host compromise would require an additional escape. No vendor-released workaround short of updating was identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Turbolev, a Chrome component, meaning memory is freed while still referenced, allowing an attacker to manipulate heap state and potentially achieve arbitrary code execution within the renderer process. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity, unauthenticated attack that nevertheless requires victim user interaction, with high confidentiality, integrity, and availability impact but scope unchanged because code execution stays inside Chrome's renderer sandbox. The affected technology is the Chromium browser engine and its multi-process sandbox architecture; exploitation is constrained by the renderer sandbox, so achieving operating-system-level compromise would require an additional sandbox-escape vulnerability. No CPE strings were supplied, but EUVD identifies Chrome 156.0.8078.47 as the fixed release threshold.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page trigger (AV:N/AC:L/PR:N) requires the user to open a page (UI:R); code execution stays within the renderer sandbox so scope is Unchanged with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity flaw that could allow an attacker to execute code inside the browser's renderer sandbox when a user visits a crafted webpage. This affects any workforce using unpatched Chrome, but sandbox confinement limits damage to the browser process and host compromise would require chaining a separate sandbox-escape flaw; no public exploit identified at time of analysis. Leadership should prioritize updating Chrome due to its broad deployment and the potential for targeted attacks, while recognizing that user interaction and sandbox boundaries reduce immediate organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB