EUVD-2026-111442
GHSA-jj47-p6c7-4v6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim loads crafted HTML page
-
ExploitTrigger use-after-free in Paint
-
ExecutionReuse freed object for control
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Chrome - the CVSS UI:R and the description's 'crafted HTML page' mean a user must browse to or render the malicious page; it is not zero-click. No authentication or special privileges are needed (PR:N) and default Chrome configurations are affected (any build prior to 156.0.8078.73 on the desktop stable channel). The principal limiting factors are the required user interaction and that resulting code execution is contained 'inside the sandbox' (S:U) per the description - turning this into a full host compromise would require chaining an additional sandbox-escape vulnerability, which is not part of this CVE. |
| Impact | Signals are mostly aligned toward a moderate-to-high but non-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction - the victim must load a crafted HTML page - which caps the real-world urgency relative to a zero-click flaw. Crucially, the description states code execution occurs 'inside the sandbox' and the scope is Unchanged (S:U), so this is a renderer-level memory-corruption primitive, not a confirmed sandbox escape or full host compromise on its own; weaponized attacks typically chain such a bug with a separate sandbox-escape. EPSS is low (0.24%, 15th percentile) and the CVE is NOT on CISA KEV, and no public exploit is identified in the input, so there is no evidence of active exploitation - consistent with a freshly disclosed Chrome stable-channel fix. The vuln.today decision label is 'this_week', matching the picture: a patch-promptly item rather than an act-now emergency. Net: a genuine high-severity browser RCE class worth prompt patching given Chrome's footprint, but current exploitation probability is low and impact is sandbox-contained per the available data. |
| Exploit ScenarioDerived | An attacker hosts or injects (e.g., via a malvertising frame or compromised site) a crafted HTML page that drives Chrome's Paint subsystem into a use-after-free, then manipulates the freed/reused object to achieve arbitrary code execution within the renderer sandbox when a victim simply visits the page. No authentication is required, but the victim must load the attacker-controlled content (UI:R). No public exploit code is identified in the provided data, and the specific trigger for the free/reuse is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Use-after-free in Google Chrome's Paint component allows a remote attacker who persuades a user to load a crafted HTML page to potentially execute arbitrary code inside the browser sandbox on versions prior to 156.0.8078.73. The issue requires user interaction and does not by itself provide a sandbox escape, so full host compromise would require an additional vulnerability. No public exploit has been identified at time of analysis, EPSS is 0.24%, and a vendor patch is available.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.73 or later; the vendor-released patch is documented in the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html and the associated Chromium issue at https://issues.chromium.org/issues/570675085. The supplied sources do not list a vendor workaround, so applying the update is the documented fix; no specific compensating control is provided in the input. The user-interaction prerequisite reduces exposure somewhat but is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-118307 is a use-after-free (CWE-416) in Chrome's Paint component, part of the rendering pipeline that processes page content. The defect is a memory-lifetime error in which an object can be freed and later reused; the supplied sources state that a crafted HTML page is the attack vector, but they do not describe the exact object or trigger sequence. Successful exploitation yields code execution within Chrome's sandbox (scope unchanged, S:U) rather than host-level compromise, and the CVSS vector reflects network access, no privileges, and required user interaction. Affected builds are Google Chrome desktop stable releases before 156.0.8078.73.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no privileges (PR:N) but user must load it (UI:R); sandbox-contained execution keeps scope unchanged (S:U) with high C/I/A on the renderer process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
CVE-2026-118307 is a high-severity use-after-free vulnerability in Google Chrome's Paint component that affects all versions prior to 156.0.8078.73. A remote attacker could exploit this by convincing a user to visit a malicious webpage, potentially leading to arbitrary code execution within the browser sandbox. While no public exploit has been identified, the widespread use of Chrome across the organization means that unpatched systems could pose a risk to users who browse untrusted content. Leadership should prioritize patching to maintain endpoint security and prevent potential incidents.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB