EUVD-2026-111460
GHSA-pgvr-mrf9-wg88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Compositing
-
ExecutionReclaim freed object via heap manipulation
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Google Chrome prior to 156.0.8078.73 to visit attacker-controlled content - a crafted HTML page (CVSS UI:R) - in a default configuration; no authentication or prior privileges are needed (PR:N, unauthenticated per PR:N). The principal LIMITING factors are: (1) mandatory user interaction (the user must load the malicious page), and (2) the resulting code execution is confined 'inside the sandbox' (renderer process) with Scope Unchanged, so a separate sandbox-escape would be needed to reach the host OS. The precise trigger mechanism in the Compositing component is not described in the available sources. |
| Impact | This is a genuine, near-term patching priority for any environment running Google Chrome. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no privileges, with the only gating factor being user interaction (UI:R) - a victim visiting a crafted HTML page. The vuln.today decision label is 'this_week', consistent with a High-severity Chromium memory-corruption bug with a vendor patch available but no confirmed active exploitation. Key signals are MISSING rather than conflicting: there is no EPSS score, no CISA KEV listing, and no verified public exploit in the provided data, so there is no evidence of in-the-wild use. One important nuance the description states explicitly: code execution is 'inside the sandbox' (renderer process), and the CVSS scope is Unchanged (S:U) - so on its own this is a renderer-level RCE that would typically need to be chained with a separate sandbox-escape to achieve full host compromise. That tempers real-world impact versus the raw 8.8. Net: real priority driven by ubiquity and a High-severity UAF with a patch, not by demonstrated exploitation. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that drives Chrome's Compositing component into a use-after-free state. A victim with an unpatched Chrome (prior to 156.0.8078.73) simply visits the page, and the attacker potentially gains arbitrary code execution within the renderer sandbox. No public exploit is identified in the provided data; full host compromise would additionally require a sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Use-after-free in Google Chrome's Compositing component (versions prior to 156.0.8078.73) allows remote attackers to corrupt memory and potentially execute arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires no authentication or prior privileges (CVSS 8.8, AV:N/AC:L/PR:N) but does require user interaction, and because the scope is unchanged the resulting code execution stays confined to the sandbox, so a separate sandbox escape would be needed to reach the host OS. The trigger mechanism inside the compositing code path is not described in the available sources; no public exploit has been identified at time of analysis, and Google has shipped a fixed build in the stable channel.
RemediationAI
Upgrade Google Chrome to 156.0.8078.73 or later, the version named in the Chrome stable channel advisory (http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html); this is recorded as a vendor-released patch and the priority label places it in this week's work. Confirm the installed build through the browser's About/version page after updating and relaunch every browser instance, since the patched binary only takes effect once the running process is restarted - sessions left open continue on the vulnerable build. Managed fleets should push 156.0.8078.73 through the normal browser update mechanism and verify endpoint compliance, prioritising users who browse untrusted web content. The referenced advisory and the Chromium issue (https://issues.chromium.org/issues/574382050) are the authoritative sources for fix scope; the supplied intelligence does not describe a configuration-level workaround, so version update is the actionable control, and no public exploit has been identified at time of analysis to change that calculus.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Google Chrome's Compositing component is part of the renderer-side graphics pipeline that assembles page layers into the frames the browser paints; a defect there runs in the same process that parses attacker-supplied HTML and CSS. The flaw is classified CWE-416 (Use After Free), meaning memory is released while a reference to it remains reachable, so subsequent use can read or write reused memory - the memory-corruption class reflected in the supplied tags (Use After Free, Memory Corruption, RCE, Denial Of Service). Because the corruption is reachable from a crafted HTML page rendered in a default browser configuration, it is a renderer-process issue: the assessed vector is S:U (Scope Unchanged), so the demonstrated impact ceiling is arbitrary code execution inside the Chrome sandbox rather than on the host. The exact compositing operation, object and sequence that trigger the free-and-reuse are not described in the available sources, and the Chromium issue tracker entry (issues.chromium.org/issues/574382050) is the primary technical record for the fix. Affected products are bounded by the fixed build 156.0.8078.73 per the Chrome stable channel advisory, with the ENISA EUVD record EUVD-2026-111460 covering the same version boundary.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted HTML page gives AV:N/AC:L/PR:N; a user must visit the page so UI:R; renderer-contained execution keeps S:U with high C/I/A within that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a high-severity use-after-free vulnerability in the Compositing component, which could allow an attacker to execute arbitrary code within the browser's sandbox. This puts all employees who use Chrome for web browsing at risk, as a successful attack requires only that a user visit a malicious webpage. While the impact is confined to the sandbox and no public exploit has been identified, the broad deployment of Chrome makes this a significant concern for organizational security.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB