EUVD-2026-111474
GHSA-77gh-q2wq-jmhc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Animation
-
ExecutionReclaim freed object via JS
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must use a Chrome desktop build prior to 156.0.8078.73 and visit or be redirected to an attacker-controlled page containing crafted HTML that exercises the Animation component (UI:R - user interaction is the primary limiter; no authentication is required per PR:N). The most significant constraint is that successful exploitation yields code execution confined to the renderer sandbox; escaping to the host requires chaining an additional, separate sandbox-escape vulnerability, materially raising the bar for full system compromise. |
| Impact | Signals are moderately strong but not emergency-grade. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a page). Notably, Google's own Chromium severity rating is Medium, which conflicts with the 8.8 High CVSS - this gap is largely explained by the description's key limiter: code execution occurs 'inside the sandbox,' meaning a single bug yields renderer-level compromise rather than full host takeover, which typically requires an additional sandbox-escape bug. There is no CISA KEV listing and no POC reference in the provided data, so exploitation status is: no public exploit identified at time of analysis. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patched, not-yet-exploited browser memory-corruption bug. Net: a genuine but routine priority - patch on the normal expedited Chrome cadence rather than treating it as an active-exploitation fire drill. Missing signals (EPSS, KEV, POC) should be re-checked, as browser UAF bugs can gain exploit tooling quickly. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that abuses the Animation component to trigger a use-after-free. When a victim running a vulnerable Chrome build (prior to 156.0.8078.73) visits the page, the dangling pointer is reused to achieve arbitrary code execution within the renderer sandbox. No public exploit code is identified at time of analysis; achieving full system compromise would additionally require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A use-after-free in Chrome's Animation component before 156.0.8078.73 lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the renderer sandbox. No authentication is required, but user interaction is the limiting factor, and code execution remains confined to the sandbox - escaping to the host demands a separate sandbox-escape chain. Google rates the Chromium severity Medium while the CVSS vector scores 8.8; the flaw was fixed in the vendor's stable channel update and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.73 or later via the stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html; confirm the installed version in chrome://settings/help or your enterprise update tooling, and verify that Chromium-based browsers in the fleet have adopted the equivalent upstream fix. Prioritize endpoints where users browse untrusted content and where renderer compromise would be most consequential. Because exploitation requires the victim to load crafted HTML, restricting users to trusted sites or enforcing script-blocking content controls reduces exposure, at the cost of breaking legitimate web functionality; note that these are partial measures only and updating is the complete fix. No other vendor-stated workaround is identified in the available sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (use-after-free) is a memory-safety class in which an object is freed while a reference to it remains, so later use of that dangling pointer reads or writes attacker-influenced memory. Here the defect sits in the Animation component of the Chromium Blink rendering engine, the subsystem handling CSS animations and the Web Animations API; the crafted HTML page exercises that code path. Chrome's multi-process architecture means the resulting corruption occurs in the renderer process, which is sandboxed, so the immediate consequence is in-sandbox arbitrary code execution rather than direct host compromise. The bug is reachable over the network with no privileges (AV:N/PR:N), requires the victim to load the crafted page (UI:R), and the trigger details beyond the Animation component are not described in the available sources. The issue was reported through Google's Chrome CVE administration process and tracked privately in the Chromium issue tracker.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to load it (UI:R); arbitrary code in the renderer gives high C/I/A, scope unchanged as impact stays within the sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a high-severity use-after-free vulnerability in the Animation component that could allow an attacker to execute arbitrary code within the browser's sandbox. This affects all employees using unpatched Chrome, but the risk is contained to the sandbox unless combined with a separate escape, making widespread compromise less likely. Leadership should prioritize patching given the high CVSS score and the browser's critical role in daily operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB