EUVD-2026-105656
GHSA-r63x-65vx-ppxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Performance component
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome desktop build (prior to 156.0.8078.47) and to actively visit or render attacker-controlled HTML (CVSS UI:R) - there is no server-side or passive-network trigger. Critically, successful code execution is CONFINED TO THE CHROME SANDBOX per the description; without a separately chained sandbox-escape, the attacker does not gain host-level execution, which is the primary factor limiting real-world impact. No authentication is required (PR:N), but the mandatory user interaction and sandbox containment are the key mitigating constraints; the released patch fully remediates. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remotely reachable, low-complexity, unauthenticated memory-corruption bug requiring only that a victim open a crafted page. However, the description is explicit that code execution occurs INSIDE the Chrome sandbox, and Google's own Chromium severity rating is only Medium - a signal that meaningfully tempers the NVD-style 8.8. A sandboxed renderer compromise is not equivalent to full host takeover; it must be chained with a separate sandbox-escape to achieve real-world system control, which is why the vendor down-rates it. No EPSS score, no CISA KEV listing, and no public POC are provided in the input, so there is no evidence of active or imminent exploitation. Net assessment: patch on the normal Chrome update cadence, but this is not a drop-everything issue in isolation - the high CVSS is driven by Chrome's ubiquity and network reach, not by confirmed exploitability or unsandboxed impact. Note the conflict to resolve: NVD CVSS 8.8 (High) versus Chromium 'Medium' - treat the vendor rating as the more context-aware signal given the sandbox containment. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects it via a compromised ad/iframe) that triggers the use-after-free in Chrome's Performance component when a victim visits it with a vulnerable Chrome build. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape for full compromise. No public exploit code is identified at time of analysis, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Performance component (all desktop builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact, but exploitation requires the user to actively visit or render attacker-controlled content and, per Google's advisory, code execution is confined to the Chrome sandbox - host-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
RemediationAI
Apply the vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, which fully remediates the flaw per the Google Stable Channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). Verify the installed version at chrome://settings/help or via chrome://version, and for fleets use Chrome Browser Cloud Management, Google Update/enterprise MSI policies, or your patch-management tooling to force the update rather than relying on user-initiated restarts. Users of Chromium-based third-party browsers should confirm their vendor has merged the corresponding upstream release. Where patching must be staged, compensating controls include restricting browsing to trusted internal sites through a proxy or URL allowlist (trade-off: reduces usability and does not protect against compromised or user-supplied content), running Chrome in a strictly enforced sandbox with renderer code integrity policies and no unsandboxed plug-ins (trade-off: some legacy enterprise web apps break), and reducing exposure by disabling or blocking untrusted HTML/JS delivery at the network edge (trade-off: high false-positive rate and maintenance overhead). These measures only reduce the attack surface; because the fix is available, upgrading remains the primary and complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free in Chrome's Performance component, the browser surface that exposes performance instrumentation and monitoring data to renderer-side content. A crafted HTML/JavaScript page can manipulate the lifetime of an object such that the component retains and later dereferences a dangling pointer, producing heap corruption and attacker-influenced memory writes within the renderer process. Because the flaw is reachable from ordinary web content rather than a privileged IPC path, the attack vector is network-based with only a user-interaction prerequisite (UI:R), and no credentials are needed (PR:N). The critical architectural constraint is Chrome's multi-process sandbox: the corruption yields arbitrary code execution inside the renderer sandbox, not on the host, so real-world severity depends on pairing this bug with an independent sandbox-escape exploit. The affected code is present in Chromium and therefore also flows into downstream Chromium-based browsers until they adopt the same upstream fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remotely reachable via crafted page (AV:N/AC:L/PR:N), requires victim navigation (UI:R), and renderer-process code execution gives high C/I/A with no sandbox-crossing scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop builds prior to version 156.0.8078.47 contain a high-severity memory-corruption flaw in the browser's Performance component that could let an attacker run code on an employee's machine when they simply open a malicious web page. Because Chrome is deployed broadly across the workforce and the attack requires only routine browsing, leadership should treat this as a fleet-wide patching priority even though the code execution is contained within the browser sandbox and no exploitation has been observed. The exposure is to confidentiality and integrity of data handled in the browser session rather than immediate full host takeover.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB