EUVD-2026-113429
GHSA-2hpj-9mv5-h6gf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryPage triggers use-after-free in Frames
-
ExploitReclaim freed object via heap manipulation
-
ExecutionHijack control flow
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML content in a vulnerable Chrome build prior to 156.0.8078.79 - consistent with UI:R, the attack is not fully automatic and depends on the user navigating to or rendering a crafted page (e.g., visiting a malicious site, a compromised page, or malicious embedded/iframe content). No special non-default configuration or authentication is indicated (PR:N). The key LIMITING factors are: required user interaction (loading the page), and that the resulting code execution is stated to occur inside the renderer sandbox - meaning full host compromise would additionally require a separate sandbox-escape, which this CVE does not describe. The precise object-lifetime trigger in the Frames code is not detailed in the available sources. |
| Impact | Signals are largely consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a remote, low-complexity, unauthenticated flaw requiring user interaction (loading a crafted HTML page), with total confidentiality/integrity/availability impact within the affected process. SSVC corroborates the impact side (Technical Impact: total) but reports Exploitation: none and Automatable: no, meaning no confirmed exploitation and no mass/automated attack path at this time. EPSS is low at 0.20% (10th percentile), the vulnerability is NOT on the CISA KEV list, and no working public exploit is identified - only a Chromium issue-tracker reference, which is a bug report rather than verified exploit code. The vendor's own 'High' Chromium severity plus the vuln.today 'this_week' decision label frame this as an important, patch-promptly item rather than a drop-everything emergency. One scoping nuance to verify: the description states code execution occurs 'inside the sandbox,' so absent a chained renderer-sandbox escape the practical blast radius is the constrained renderer process, which tempers real-world severity relative to the raw 8.8. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing HTML crafted to trigger the use-after-free in Chrome's Frames handling; a user with a vulnerable Chrome build simply visits or is redirected to the page (the UI:R / user-interaction requirement). Successful exploitation yields arbitrary code execution within the browser's sandboxed renderer process. No public working exploit is identified at time of analysis - only a Chromium bug-tracker reference exists, which is not verified exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Use-after-free in Google Chrome's Frames component before 156.0.8078.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction, and the resulting code execution is confined to the sandbox; full host compromise would require a separate sandbox escape that this CVE does not describe. The vendor has released a fixed build, while the supplied data shows no public exploit identified at time of analysis and an EPSS score of 0.20% (10th percentile).
RemediationAI
Upgrade Google Chrome to 156.0.8078.79 or later; the vendor-released patch is documented in the Chrome stable channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html and the Chromium issue at https://issues.chromium.org/issues/573264074. The supplied references do not list a vendor workaround, so remediation is to apply the fixed build, then restart Chrome so the updated browser process is running. No vendor-released patch gap is indicated in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-119260 is a CWE-416 use-after-free in Chrome's Frames component, a memory-safety class in which an object is freed while still referenced, enabling memory corruption that can be steered toward code execution. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and EUVD lists Chrome builds below 156.0.8078.79 as affected; exploitation requires rendering attacker-controlled HTML in a vulnerable build, and the resulting code execution is described as occurring inside the renderer sandbox rather than at host privilege. The available sources do not describe the specific Frames object-lifetime trigger or the exact heap layout, and SSVC marks exploitation as none and automation as no at time of analysis.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; requires the user to load the page (UI:R); sandboxed code execution keeps scope unchanged (S:U) with full C/I/A impact in-process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.79 contain a high-severity use-after-free flaw in the Frames component that allows a remote attacker to execute arbitrary code within the browser's sandbox when a user visits a malicious webpage. While exploitation requires user interaction and remains confined to the sandbox, a successful attack could lead to data theft, session hijacking, or further compromise if chained with an additional sandbox escape. Leadership should prioritize patching because Chrome is widely deployed and browser-based attacks are a common initial access vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB