EUVD-2026-105525
GHSA-5g6c-g74h-5pwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in sandbox
-
ExecutionExecute arbitrary code in renderer process
-
ImpactOperate within sandbox boundary (escape requires separate bug)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to actively open attacker-controlled web content in Chrome (UI:R) - e.g., visiting a malicious site, a compromised legitimate site, or malicious ad/iframe content - rendering a crafted HTML page that triggers the memory-corruption bug. No authentication or prior privileges are needed (PR:N). The key LIMITING factor is that resulting code execution is confined to the sandboxed process (S:U, no sandbox escape), so standalone impact is bounded unless chained with a separate sandbox-escape vulnerability; a second limiter is the mandatory user interaction. Affects Chrome desktop builds prior to 156.0.8078.47. |
| Impact | Signals conflict on severity and must be reconciled. The input CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which rates this High, yet Google's own Chromium severity rating is Medium - and the description resolves the discrepancy: the flaw yields arbitrary code execution INSIDE the sandbox (S:U, no scope change), not a sandbox escape, so an attacker gains control of the sandboxed renderer process but remains contained by Chrome's sandbox boundary. That containment is why the CVSS High score overstates practical impact relative to Chromium's Medium rating; weaponization typically requires chaining this with a separate sandbox-escape bug for full host compromise. Exploitation requires user interaction (UI:R - the victim must open a crafted page) but no privileges (PR:N) and no authentication. No EPSS score was provided, there is no CISA KEV listing, and no public exploit is identified, so there is no evidence of active or imminent exploitation. Net: this is a patch-promptly item given Chrome's ubiquity and the low exploitation barrier, but it is not an emergency relative to a confirmed full-RCE/sandbox-escape or a KEV-listed bug. Prioritize via normal rapid browser-patching cadence. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects crafted content into a compromised/ad-served page) and lures a victim running an unpatched Chrome build to visit it. The crafted HTML triggers memory corruption (CWE-119) in a sandboxed component, letting the attacker execute arbitrary code within the renderer sandbox; full host compromise would require chaining a separate sandbox-escape. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's sandboxed renderer (desktop builds prior to 156.0.8078.47) lets a remote, unauthenticated attacker execute arbitrary code inside the sandbox when a user opens a crafted HTML page. Because the CVSS vector specifies UI:R and S:U, exploitation requires a deliberate user visit to attacker-controlled content (malicious site, compromised legitimate site, or injected ad/iframe) and the resulting code execution stays confined to the renderer process - meaningful standalone impact is bounded unless the bug is chained with a separate sandbox-escape flaw. Signals conflict on severity: the 8.8 base score (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H) reflects full confidentiality, integrity and availability loss within the renderer, while Google rates it Chromium security severity Medium, consistent with a sandbox-confined, user-interaction-gated issue; no public exploit code or CISA KEV entry was identified at time of analysis, so real-world risk currently rests on targeted exploitation rather than mass scanning.
RemediationAI
Vendor-released patch: upgrade Chrome to 156.0.8078.47 or later, distributed through the standard stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; verify the installed build on chrome://version and treat the Chromium issue at https://issues.chromium.org/issues/502376419 as the technical reference. Enterprises should force the update through Chrome Browser Cloud Management, an on-premises update server, or OS-level package management, and can pin the fixed build as a minimum version policy; browsers on extended-stable or pinned-version tracks need an explicit rebase decision because they will otherwise remain exposed. No vendor workaround exists for the underlying memory-corruption defect, so compensating controls are exposure reducers only and carry real trade-offs: enforce URL/domain allowlisting or DNS filtering to shrink the set of pages that can reach the renderer (side effect: breaks long-tail browsing and third-party ad/SSO flows), keep Site Isolation and the renderer sandbox enabled since disabling them - including running with sandbox flags off - converts a sandbox-confined bug into host-level compromise and must not be used as a mitigation, and consider disabling the JIT (--js-flags=--jitless) on high-risk kiosk or admin browsing profiles to make heap-grooming exploits harder (side effect: significant JavaScript performance loss and possible site breakage, and it is not a supported substitute for patching). Prioritize patching for users who routinely browse untrusted content or hold privileged credentials, since exploitation requires only a single page view and chaining with a separate sandbox-escape vulnerability would raise impact substantially.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper-restriction-of-operations-within-a-memory-buffer defect in Chrome's browser-engine memory handling - the classic class covering out-of-bounds reads/writes and buffer overflows arising when length or index values are not validated against the bounds of an allocated object. Chrome's multi-process architecture places HTML parsing, JavaScript execution and rendering inside a heavily sandboxed renderer process that runs at low privilege with a restricted syscall/OS-resource surface; a memory-corruption primitive inside that process yields code execution at renderer privilege, not at OS user privilege. The attack path is therefore network-delivered content (AV:N) requiring the victim to load the crafted page (UI:R) with no credentials or prior footholds (PR:N); the S:U scope value confirms the vulnerable component and the impacted component are the same and that no privilege boundary is crossed by this bug alone. The practical consequence is that weaponization typically pairs this primitive with an independent sandbox-escape bug to reach the host, and this advisory therefore carries a Medium Chromium severity despite the higher generic CVSS base score. The upstream tracking record is Chromium issue 502376419, reported via chrome-cve-admin@google.com.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N/AC:L/PR:N) requiring a page visit (UI:R); code runs within the sandboxed process so scope is unchanged (S:U) with full impact on that process (C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop deployments prior to 156.0.8078.47 are exposed to a memory-corruption flaw that lets an attacker run code inside the browser's sandboxed renderer when a user visits a crafted page. The practical business risk is bounded by the sandbox and the required user interaction, but the wide Chrome footprint and the potential for chaining with a separate sandbox-escape bug make timely remediation important. Leadership should prioritize fleet-wide patching to reduce exposure across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB