EUVD-2026-111461
GHSA-6x29-7qp3-4f97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger out-of-bounds write in Editing component
-
ExecutionCorrupt memory to escape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled crafted HTML in Google Chrome (UI:R / active user interaction such as visiting a malicious or compromised page); no authentication or prior privileges are needed (PR:N). The vulnerable surface is the Editing component, and the described impact - code execution 'outside the sandbox' - indicates a sandbox-escaping out-of-bounds write (CWE-787), consistent with the scope change (S:C). Limiting factors: the attack is not fully automatic (it needs a user to visit the page) and it affects only Chrome builds prior to 156.0.8078.73, so patched installations are not exploitable. The exact memory-corruption trigger within the Editing component is not described in the available sources. |
| Impact | This is a genuine high priority despite a low EPSS score, and the signals must be weighed carefully rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page, with a scope change reflecting the stated sandbox escape ('execute arbitrary code outside the sandbox') - an unusually severe outcome for a browser memory-corruption bug, since most renderer flaws remain confined to the sandbox. Against this, EPSS is only 0.21% (11th percentile), but that low probability is expected for a freshly disclosed Chrome CVE and does not contradict the severity: EPSS measures observed/predicted exploitation volume, not technical exploitability. There is no CISA KEV listing and no confirmed public exploit, so active exploitation is NOT established. The vuln.today decision label is 'act_now', driven by the critical CVSS, the sandbox-escape impact, and the availability of a vendor patch, rather than by in-the-wild activity. Net: a real, patch-now issue because of impact and ease of reach, but current evidence points to no confirmed exploitation - the urgency is pre-emptive, anchored on the scope-changing RCE potential, not on observed attacks. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the out-of-bounds write in Chrome's Editing component when the victim visits it. Because the flaw reportedly allows code execution outside the sandbox, a single drive-by page load could lead to arbitrary code execution on the victim's host. No public exploit code has been identified at time of analysis, and the precise trigger within the Editing component is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Out-of-bounds write in Google Chrome builds prior to 156.0.8078.73 can allow code execution outside the browser sandbox when a victim opens a crafted HTML page. Exploitation is remote and does not require authentication, but it does require user interaction; successful attacks can affect confidentiality, integrity, and availability with a scope change beyond the browser process. No public exploit was identified at time of analysis, and EPSS is low at 0.21% (11th percentile), yet the supplied priority decision is act_now and a vendor patch is available.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.73. Upgrade Google Chrome to 156.0.8078.73 or later and restart the browser to apply the update. The vendor stable-channel advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html and the Chromium issue is https://issues.chromium.org/issues/574412629. No specific workaround or compensating control is described in the supplied references; replacing affected pre-156.0.8078.73 builds is the remediation supported by the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write, in Chrome's Editing component. According to the supplied assessment, the described impact of code execution 'outside the sandbox' indicates a sandbox-escaping memory-corruption issue, which is consistent with the CVSS scope change (S:C). The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H: network reachability, low attack complexity, no privileges required, and required user interaction. The exact memory-corruption trigger inside the Editing component is not described in the available sources, so the specific malformed HTML construct and vulnerable code path remain unconfirmed. Affected builds are those prior to 156.0.8078.73; no CPE strings were provided in the input.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted HTML needs no privileges (PR:N) but requires a page visit (UI:R); the stated sandbox escape justifies S:C with full C/I/A impact on the host.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a critical out-of-bounds write vulnerability (CVE-2026-118342, CVSS 9.6) that can allow code execution outside the browser sandbox when a user opens a crafted HTML page. This puts the entire organization at risk, as a single visit to a malicious website could compromise endpoints, leading to data theft, operational disruption, and potential lateral movement. Leadership should prioritize immediate patching because the vulnerability is remotely exploitable without authentication and requires only user interaction, which is commonplace in daily business operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB