EUVD-2026-111467
GHSA-j9rq-w8vj-87jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious HTML to browser
-
ExecutionTrigger use-after-free in Modularization
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled crafted HTML in Chrome versions prior to 156.0.8078.73 (UI:R) - there is no server-side or unauthenticated-push vector. No special non-default Chrome configuration is indicated by the description. The decisive limiting factor is that code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'): this flaw alone does not compromise the host operating system, so a separate sandbox-escape would be needed for full device control. The precise object-lifecycle trigger within the Modularization component is not described in the available sources. |
| Impact | This is a genuine priority within the Chrome patching cycle, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) indicates a network-reachable, low-complexity flaw needing no privileges but requiring user interaction - the victim must load a crafted HTML page. The vuln.today decision label is 'this_week', consistent with a serious browser memory-corruption bug that is patched but not under known active exploitation. No KEV listing is present in the input, so there is no confirmation of active exploitation; no EPSS score was supplied, so widespread-exploitation probability cannot be quantified. No verified public exploit is indicated. A key scope-limiting signal: the description states code executes 'inside the sandbox' (S:U, no scope change), meaning this alone does not grant host compromise - an attacker would need to chain a separate sandbox escape for full system control. Net: real priority for prompt patching given Chrome's ubiquity and the RCE class, but the sandbox-contained impact and absence of KEV/EPSS/exploit signals argue against treating it as an emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Modularization component when a victim visits it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, typically requiring a further sandbox-escape chain to reach the host. No verified public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Use-after-free in Google Chrome's Modularization component before 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is required, but exploitation hinges on the target loading the attacker's HTML, and the impact is bounded by Chrome's sandbox - this flaw alone does not give control of the host operating system, so a separate sandbox escape would be needed for full device compromise. Chromium rates it High (CVSS 8.8), and no public exploit code or confirmed active exploitation is identified in the available data; the priority call is 'this_week', positioning it as a genuine priority within the normal Chrome patching cycle rather than a drop-everything emergency.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.73, as announced in the Stable Channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html; confirm the running build via chrome://version after restarting the browser, since the update only takes effect once all Chrome processes are relaunched. Patch status is 'available from vendor' with the exact fixed version identified, and the priority label places this in the current week's patching cycle rather than an emergency out-of-band response. The supplied advisory and issue tracker do not document any configuration workaround or feature flag that removes exposure, so on managed fleets the practical route is to force the 156.0.8078.73 update through the normal Google Update/enterprise update policy channel and verify compliance, accepting that until a device has the fixed build a user who opens crafted HTML on that device remains exposed. Because code execution is confined to the renderer sandbox (S:U), the residual risk on unpatched endpoints is the sandboxed RCE and crash/denial-of-service impact described in the tags - not direct host compromise - unless chained with a separate sandbox escape; treat sandbox-escape protections as the compensating layer while the update rolls out, with the trade-off that they reduce but do not eliminate the consequences of this flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free: a memory object in Chromium's Modularization component is released while a reference to it survives, and the subsequent dereference of that dangling pointer corrupts memory in a way that can be steered into arbitrary code execution. Modularization is the internal Chromium layer that organizes component boundaries, so the defect sits in browser code reachable from web content rather than in a server-side service. The supplied sources do not describe the exact object lifecycle or the precise trigger sequence that produces the dangling reference, so the specific allocation/free path cannot be stated from this evidence. Per the description and assessed vector the resulting code execution stays inside the renderer sandbox (S:U 'inside the sandbox'), meaning the affected product is Google Chrome builds below 156.0.8078.73 and the practical blast radius is the sandboxed renderer; the associated tags note memory corruption and denial-of-service potential alongside RCE, and the reporter is the Chrome CVE admin account with an ENISA EUVD record (EUVD-2026-111467) mirroring the same fixed version.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges but requires the user to visit it (UI:R); code runs in-sandbox so scope is unchanged (S:U) with high C/I/A within the renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a high-severity use-after-free vulnerability (CVE-2026-118341) that could allow an attacker to execute code within the browser sandbox. This affects all employees using Chrome for web browsing. While exploitation requires a user to visit a malicious webpage and does not directly compromise the host operating system, it still poses a significant risk of data theft or malware infection within the browser context, warranting prompt patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB