EUVD-2026-113435
GHSA-5q84-5qp7-7w2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Quota
-
ExecutionReclaim freed object via script
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (any version prior to 156.0.8078.79); per CVSS UI:R, user interaction (visiting or rendering the malicious page) is mandatory, which is the primary limiting factor. No authentication or special privileges are needed (PR:N). The specific feature involved is Chrome's Quota subsystem, but the available sources do not describe what configuration or storage/quota API sequence triggers the use-after-free. A significant impact limiter is that the description scopes code execution to 'inside the sandbox' (S:U) - reaching the underlying OS would require chaining an additional sandbox-escape vulnerability, which is not part of this CVE. |
| Impact | Signals point to a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a page) and does not change scope, with high confidentiality, integrity and availability impact. Crucially, the description states code execution occurs 'inside the sandbox,' so this is a renderer-level memory-corruption bug, not a confirmed sandbox escape - real-world impact typically requires chaining with a separate sandbox-escape bug to reach the host. The exploitation signals temper the raw score: SSVC reports Exploitation 'none' and Automatable 'no' (consistent with UI:R), EPSS is only 0.20% (10th percentile), there is no CISA KEV listing, and no confirmed public exploit. Technical Impact is 'total,' matching the CWE-416 use-after-free, but the low EPSS and SSVC 'none' indicate no observed or automatable exploitation at analysis time. The vuln.today decision label is 'this_week,' which aligns with a patched, high-severity browser bug that is worth prompt patching but is not flagged act_now/emergency. Net: a real priority to patch this week, not a high-CVSS-but-illusory issue, yet the in-sandbox confinement and absence of exploitation evidence argue against treating it as an active-threat emergency. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML/JavaScript that drives Chrome's Quota subsystem into a use-after-free; when a victim with a vulnerable Chrome build (prior to 156.0.8078.79) visits the page, the freed object is reclaimed and manipulated to achieve arbitrary code execution within the renderer sandbox. No authentication is required but user interaction (loading the page) is, per CVSS UI:R. No public exploit has been identified at time of analysis, and the specific memory-grooming trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Arbitrary code execution confined to the Chrome renderer sandbox is possible in Google Chrome builds prior to 156.0.8078.79, where a use-after-free in the Quota component is reachable when a victim renders a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the target must visit or load the attacker-controlled page - and the description scopes the resulting code execution to 'inside the sandbox', so impact on the underlying operating system would require chaining a separate sandbox-escape flaw not covered by this CVE. No public exploit or PoC is identified in the available sources, CISA SSVC records Exploitation: none and Automatable: no, EPSS is low at 0.20% (10th percentile), and a vendor patch exists, which places this at a this_week remediation cadence rather than an emergency response.
RemediationAI
Vendor-released patch: 156.0.8078.79 - upgrade Google Chrome to 156.0.8078.79 or later through the stable channel, as documented in the Chrome release advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html, and track the underlying fix in the Chromium issue at https://issues.chromium.org/issues/575202553. Because exploitation requires only that a user render a crafted HTML page in an unpatched build, prioritise the update on user-facing browsing endpoints and verify the reported version after rollout; Chromium normally restricts technical detail on the bug until most of the user base has updated, so interim detail may be limited. The provided sources do not describe a supported workaround or configuration flag that disables the affected Quota code path, so no feature-level mitigation can be recommended from this data; where an endpoint cannot be updated immediately, the only evidence-consistent options are constraining browsing of untrusted content and limiting exposure until the fixed build is deployed, with the understanding that these reduce but do not remove the attack surface. No vendor-stated compensating control is available beyond applying the update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-416 use-after-free in Chrome's Quota subsystem - the browser-side infrastructure that tracks and enforces per-origin storage quotas for web platform storage APIs. A use-after-free means a heap object is released while a reference to it is still held; subsequent dereference of that dangling pointer can corrupt memory and, in a browser, give an attacker a path to controlled execution within the renderer process. Consistent with that, the Chromium severity rating is High and the assessed CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, i.e. network-reachable, no privileges required, but gated on user interaction, and unchanged scope - the exploit primitive lands in the sandboxed process, not the browser's privileged broker. The affected CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covers all Chrome builds below the fixed release. The available sources do not describe which specific quota API sequence or configuration state triggers the dangling reference, so the precise trigger preconditions remain unverified from public data; the only confirmed prerequisite is that the victim render attacker-supplied HTML in an unpatched build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but mandatory user interaction (UI:R); use-after-free yields full renderer compromise confined to the sandbox, so S:U with C/I/A:H.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.79 contain a use-after-free vulnerability that allows an attacker to execute arbitrary code within the browser's renderer sandbox when a user visits a malicious webpage. While the sandbox limits the immediate impact to the browser process, a successful attack could lead to data theft or further compromise if chained with a separate sandbox-escape exploit. Given the widespread use of Chrome across the organization, this poses a medium risk that warrants prompt patching to prevent potential user-level compromises.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB