EUVD-2026-113434
GHSA-pxjg-5pmw-3vm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Quota component
-
ExecutionExecute arbitrary code in renderer
-
ImpactCode execution confined to Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to load attacker-controlled web content in Chrome prior to 156.0.8078.79 (UI:R / UI:P - the user must visit or render a crafted HTML page), with no authentication or special privileges needed (PR:N). The attack works against default configurations; no non-default feature or setting is called out in the available sources. The key limiting factors are: (1) required user interaction to open the malicious page, which prevents fully automated mass exploitation (SSVC Automatable: no); and (2) the resulting code execution is confined to the renderer sandbox, so full host compromise would additionally require a separate sandbox-escape vulnerability. The precise trigger within the Quota component is not described in the available sources. |
| Impact | Signals are mostly aligned toward a real but non-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted HTML page). Critically, the description states the arbitrary code executes 'inside the sandbox' - meaning this is renderer-level compromise with scope unchanged (S:U), not a full host takeover, which tempers real-world impact since a sandbox escape would additionally be required for system control. SSVC reinforces a measured posture: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (user interaction breaks mass automation), Technical Impact 'total' (within the affected component). EPSS is low at 0.20% (10th percentile), and the vuln.today Decision label is 'this_week' - not act_now or emergency. KEV status is not present in the input (treat as not KEV-listed). No confirmed public exploit code is indicated. In short: a genuinely high-severity browser memory-corruption bug worth patching on a normal rapid cadence, but current evidence shows no active exploitation and the sandbox confinement plus required user interaction lower immediate real-world risk relative to the raw 8.8 score. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing specially crafted content that triggers the memory-corruption flaw in Chrome's Quota component when a victim browses to it. Successful exploitation could let the attacker run arbitrary code within the renderer sandbox. No public exploit code is identified in the available data, and executing code outside the sandbox would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Memory corruption in the Quota component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox by convincing a user to load a crafted HTML page; all builds prior to 156.0.8078.79 are affected. Exploitation needs the victim to visit or render attacker-controlled content (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit has been identified at time of analysis, SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.20% (10th percentile), which supports a this_week rather than emergency response cadence; the vendor has released a fixed build.
RemediationAI
Vendor-released patch: update Google Chrome to 156.0.8078.79 or later, as published in the stable channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html; enterprise fleets should verify the deployed build against that version rather than relying on auto-update status alone. No workaround or configuration-level mitigation is documented in the available sources, so upgrading is the complete fix. Because exploitation requires a victim to load crafted web content and the payload is contained by the renderer sandbox, exposure is reduced but not eliminated until the browser is patched, and any compromise of the browser process would still require a separate sandbox-escape vulnerability to reach the host.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-119 (improper restriction of operations within the bounds of a memory buffer), the same class as the buffer-overflow tag attached to this record, and sits in Chromium's Quota subsystem - the QuotaManager and storage-quota APIs that back web storage accounting and requests for additional storage from pages. Corruption of memory managed by that component would be reachable from web content processed in the renderer, which is why the impact is scored as full confidentiality, integrity and availability loss within the sandboxed process (S:U). The precise trigger inside Quota is not described in the available sources, and the CVSS metrics only convey severity and preconditions (network vector, low attack complexity, no privileges, required user interaction) rather than the specific code path involved. CPE coverage is the generic google:chrome entry, so every channel build older than 156.0.8078.79 should be treated as affected pending confirmation of the exact branch fixes in the stable channel advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges gives AV:N/AC:L/PR:N; a victim must load the page (UI:R); code stays within the renderer sandbox so S:U with high C/I/A in that component.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.79 contain a high-severity memory corruption flaw in the Quota component that could let an attacker run code within the browser's renderer sandbox when a user simply visits a crafted web page. Because exploitation is confined to the renderer sandbox and no public exploit has been identified, the primary exposure is to the broad base of employees browsing the web on unpatched Chrome installations. Leadership should care because Chrome is a ubiquitous enterprise attack surface, and unmanaged or delayed browser updates leave the workforce exposed through routine web activity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB