EUVD-2026-111447
GHSA-pmmf-pwgp-32m7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage delivers malicious WebAudio content
-
ExecutionTrigger memory corruption in WebAudio
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 156.0.8078.73 to load an attacker-controlled HTML page containing crafted WebAudio content - this user interaction (UI:R: the victim must visit the page) is the primary limiting factor; no authentication and no non-default configuration are needed (PR:N, AV:N against default WebAudio-enabled Chrome). The impact is explicitly confined to the renderer sandbox (scope unchanged), so arbitrary code execution does not by itself reach the host operating system; full host compromise would require chaining an additional sandbox-escape vulnerability. The only complete fix stated by the evidence is updating to Chrome 156.0.8078.73 or later. |
| Impact | This is a genuine priority within its stated scope, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remotely reachable, low-complexity, unauthenticated flaw that requires only that a victim load a crafted HTML page - a trivially satisfiable interaction for a browser. Chromium itself rated the security severity High. The key mitigating signal is in the description: arbitrary code execution is 'inside the sandbox,' i.e. scope is unchanged (S:U) and this is NOT by itself a sandbox escape, so an attacker would need to chain a second bug to reach the host. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided in the input, so there is no evidence of active exploitation; the only real-world urgency signal is the vendor-pipeline priority label 'this_week.' The data is internally consistent - network vector matches the crafted-HTML-page delivery described - with no CVSS-versus-description conflict to flag. Treat this as a standard high-severity browser update: ubiquitous footprint and easy delivery justify prompt patching, but the sandbox-confined impact and absence of exploitation signals place it below KEV-listed or escape-chaining bugs. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing malicious WebAudio content and lures a victim running a vulnerable Chrome build (prior to 156.0.8078.73) to visit it. Loading the page triggers the WebAudio memory corruption, potentially giving the attacker arbitrary code execution within the renderer sandbox. No public exploit was identified in the provided data, and the attacker would still need a separate sandbox-escape bug to affect the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Loading a crafted HTML page can trigger memory corruption in Google Chrome's WebAudio component before version 156.0.8078.73, potentially allowing code execution inside the renderer sandbox. The attack is remote and requires no authentication, but user interaction is required because the victim must visit the attacker-controlled page; scope is unchanged, so host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.73 as the fix.
RemediationAI
Upgrade Google Chrome to 156.0.8078.73 or later; this is the only complete fix stated by the evidence. Allow Chrome's stable-channel update mechanism to apply the release or install it directly, then restart the browser and verify the version. The vendor advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html and the Chromium issue is at https://issues.chromium.org/issues/572191610. No vendor-stated workaround was supplied, and the evidence does not describe an alternative that fully addresses the WebAudio memory corruption.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Google Chrome's WebAudio implementation processes audio content in the renderer. CVE-2026-118358 is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, and the supplied description attributes the issue to memory corruption in WebAudio. The exact faulty operation or trigger is not described in the available sources. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: remote reachability, no authentication, required victim interaction through page visitation, and scope unchanged so the assessed impact remains confined to the renderer sandbox. The supplied tags include RCE and Buffer Overflow, which are consistent with the memory-corruption classification but do not change the assessed sandbox-confined impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote, unauthenticated delivery via a crafted web page needing only a victim visit (UI:R); code execution is sandbox-confined so scope is unchanged with full C/I/A impact in that context.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 156.0.8078.73 contain a high-severity memory corruption flaw in the WebAudio component that could let an attacker execute code within the browser's renderer sandbox if a user visits a malicious webpage. This affects all employees using unpatched Chrome, creating a risk of malware infection or data theft, though full system compromise would require an additional sandbox escape. Leadership should prioritize patching to protect the workforce and reduce exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB