EUVD-2026-111427
GHSA-xh9x-h28f-hq8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in FileSystem
-
ExecutionReuse freed object for memory corruption
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled crafted HTML page in Chrome prior to 156.0.8078.73 (UI:R) - it is not a drive-by against a passive service and needs no authentication or special configuration beyond running the affected browser version. The key limiting factors are: (1) mandatory user interaction (visiting/rendering the malicious page); (2) resulting code execution is confined to the renderer sandbox per the vendor description, so full host compromise requires an additional sandbox-escape vulnerability; and (3) users on 156.0.8078.73 or later are not affected. No non-default feature toggle is named in the description. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction - the victim must open a crafted HTML page. Chromium rates the security severity High. The decision label is 'this_week' (not act_now/emergency), which is consistent with a serious but not actively-exploited browser bug. There is no KEV listing and no EPSS score in the supplied data, so no evidence of current in-the-wild exploitation; the chromium issue tracker reference (issues.chromium.org/562191732) is a restricted bug entry, not verified working exploit code. A critical scoping nuance the raw 8.8 obscures: the description states code execution occurs 'inside the sandbox,' so successful exploitation yields renderer-level compromise that still requires a separate sandbox-escape chain to reach the host - the CVSS C:H/I:H/A:H reflects renderer-process impact, not full system takeover on its own. This is a genuine priority for patch rollout given Chrome's footprint, but the absence of KEV/EPSS signals and the sandbox confinement argue for prompt scheduled patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's FileSystem component. A victim running an unpatched Chrome (prior to 156.0.8078.73) visits the page, and the freed-object reuse is leveraged to execute attacker-controlled code within the renderer sandbox. No public, verified exploit code was identified in the supplied data; the referenced Chromium issue is a restricted bug tracker entry rather than a working PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Use-after-free in Google Chrome's FileSystem component allows a remote attacker who convinces a victim to open a crafted HTML page to corrupt memory and potentially execute arbitrary code inside the browser's renderer sandbox in versions prior to 156.0.8078.73. Exploitation is network-reachable, low-complexity and requires no authentication, but it is gated by user interaction - the target must actively load and render the attacker-controlled page - and any resulting code execution is confined to the sandbox, so full host compromise would additionally require a separate sandbox escape. Google rates the issue Chromium security severity High and has released 156.0.8078.73 as the fixed build; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a patch-this-week item rather than a confirmed active campaign.
RemediationAI
Upgrade Google Chrome to 156.0.8078.73 or later through the Chrome stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html; the vendor states a patch is available, and that build is the exact fixed version. Because Chrome applies updates on restart, confirm the browser has been fully relaunched and verify the version via chrome://version so the fix is actually live. Enterprises managing Chrome should push 156.0.8078.73 (or a later build) through their update mechanism and confirm version compliance across endpoints; Chromium-based browsers with independent release trains should be updated once their vendor ships the equivalent fix, since no separate advisory was provided for them. The available sources name no configuration toggle or feature flag that disables the vulnerable FileSystem path, and the vendor's advisory presents updating as the fix, so no feature-level workaround can be recommended from this data; the renderer sandbox limits the direct consequence of a successful exploit to sandboxed code execution, but it does not prevent the memory corruption itself and should be treated as a damage limiter rather than a mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free: a heap object owned by Chrome's FileSystem implementation is released while a live reference to it remains, so subsequent access reads or writes freed memory and can be shaped into memory corruption. The FileSystem component is the browser-side plumbing behind the file and filesystem abstractions exposed to web content (directory/entry handles, blob-backed storage and related renderer-to-browser file operations), meaning the dangling reference is reachable from ordinary HTML and script rather than from a privileged local context. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms a network-delivered, low-complexity, unauthenticated attack whose only prerequisite is that the victim open the crafted page; the specific sequence of API calls or object lifetime that triggers the free and reuse is not described in the available sources. Because the flaw lives in the renderer-reachable FileSystem code and is explicitly described as allowing code execution 'inside the sandbox', the maximum immediate impact is renderer compromise, with host-level impact requiring a chained sandbox-escape bug. Affected CPE data was not supplied; the only confirmed affected build range is Chrome desktop stable below 156.0.8078.73 per the Chrome Releases advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; a victim must open the page (UI:R); code runs within the sandbox so scope stays unchanged (S:U) with high renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a use-after-free vulnerability in the FileSystem component that could allow an attacker to execute code within the browser's renderer sandbox when a user visits a malicious webpage. This affects all employees using unpatched Chrome, creating a risk of malware infection or data theft through drive-by downloads, though exploitation requires user interaction and no active attacks have been observed. Leadership should prioritize patching this week to prevent potential exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB