EUVD-2026-111453
GHSA-47m4-pr5w-69g4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
ExploitDeliver malicious media content
-
ExecutionTrigger memory corruption in Media component
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled content in Chrome - the crafted HTML page must be processed by the browser's Media component, so user interaction (UI:R) is a hard prerequisite and there is no drive-by-without-visit path. No authentication is required (PR:N). A key limiting factor is that, per the description, code execution is achieved INSIDE the sandbox; converting this into host-level compromise would require a separate sandbox-escape vulnerability not covered by this CVE. Affected: Chrome versions prior to 156.0.8078.73; updating to 156.0.8078.73 or later removes exposure. |
| Impact | Signals are mostly consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing user interaction (visiting a crafted HTML page) and no privileges, which matches the description. Google/Chromium rates the security severity High. Counterbalancing this, EPSS is low at 0.22% (13th percentile), the CVE is NOT listed in CISA KEV, and no public exploit is identified in the input - so there is no evidence of active exploitation. One nuance the raw score hides: the description states code execution occurs 'inside the sandbox,' i.e. in the sandboxed renderer rather than a confirmed sandbox escape; full host compromise would require chaining a separate sandbox-escape bug, which the available data does not establish. The vuln.today priority of 'this_week' aligns with a High-severity, patched, but not-actively-exploited browser bug: a real priority to patch promptly, not a drop-everything emergency. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted media content and lures a Chrome user to visit it. When the browser's media component processes the content, the memory-corruption flaw is triggered, potentially allowing arbitrary code execution within the sandboxed renderer process. No public exploit code is identified in the input, and the specific trigger mechanics are not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Memory corruption in the Media component of Google Chrome prior to 156.0.8078.73 lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) and is rated High by Chromium security severity; exploitation is not confirmed in the wild, no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (13th percentile), though the vendor classifies it among the higher-severity fixes in this stable-channel release. Because the described impact is code execution inside the sandbox, host compromise would additionally require a separate sandbox-escape vulnerability not covered by this CVE; patched builds are available in 156.0.8078.73 and later.
RemediationAI
Vendor-released patch: update Google Chrome to 156.0.8078.73 or later via the stable-channel release referenced at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html (details also tracked at https://issues.chromium.org/issues/573938968). Managed fleets should push the updated build through their normal update mechanism and verify the reported browser version, since the fix is delivered only once the new version is actually running; users on unmanaged installs should relaunch Chrome to complete a pending update. Until the update is applied, exposure is limited to users who open crafted HTML content in an unpatched browser, so restricting browsing of untrusted pages reduces the window, but the vendor's stable-channel release is the complete fix and no alternative configuration-based mitigation is stated in the available sources. Given the this_week priority label, schedule the update within the current patch cycle rather than deferring it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer) in Chrome's Media component, the subsystem responsible for parsing and decoding media content and related container/stream data within the renderer process. Bounds errors of this class typically arise when length, offset or index values taken from attacker-supplied input are not validated before memory access, allowing out-of-bounds reads or writes that can be shaped into code execution within the renderer's sandboxed address space. The specific trigger for this issue is not described in the available sources; the Chromium issue tracker entry (issues.chromium.org/issues/573938968) is referenced but its technical detail is not reproduced here. The CVSS vector confirms the attack is network-reachable, low complexity and requires user interaction, and that confidentiality, integrity and availability impacts are all High within the scope of the browser process. The sandbox boundary is the key containment control: code execution achieved inside the sandbox does not by itself yield operating-system-level compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remotely reachable via a crafted page (AV:N, AC:L, PR:N) but requires the user to visit it (UI:R); memory corruption yields high C/I/A within the unchanged sandbox scope (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a high-severity memory corruption flaw in the Media component that could allow remote code execution within the browser sandbox if a user visits a malicious webpage. This puts all employees who use Chrome for web browsing at risk, though exploitation requires user interaction (clicking a link or opening a page). Leadership should prioritize patching because successful exploitation could lead to data compromise or further network intrusion if combined with a sandbox escape, and the vendor has classified this as a higher-severity fix.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB