EUVD-2026-113440
GHSA-gw87-697q-v4qc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryServe malicious HTML to Chrome
-
ExploitTrigger Skia use-after-free (CWE-416)
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactAchieve sandbox-confined RCE (escape needed for host)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 156.0.8078.79 to load a crafted HTML page (UI:R / passive user interaction) - a classic drive-by or malicious-link vector with no authentication and no special configuration needed against default installs. The principal limiting factor is that resulting code execution is explicitly confined to the renderer sandbox; achieving full host compromise would require chaining an additional sandbox-escape vulnerability. Exploitation is further bounded to the affected version range (anything before 156.0.8078.79); patched builds are not affected. |
| Impact | Signals point to a credible but not emergency-grade priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw that only requires a user to open a crafted page, with high confidentiality, integrity and availability impact. That raw score, however, is tempered by three converging low-urgency indicators: EPSS is only 0.20% (10th percentile), the CVE is NOT on CISA KEV, and the CISA SSVC decision records Exploitation=none and Automatable=no (though Technical Impact=total). The vuln.today decision label is 'this_week', i.e. prompt patching rather than act-now/emergency. A key scoping nuance: the description explicitly says code execution is 'inside the sandbox' (consistent with CVSS S:U), so a successful exploit is confined to the Chrome renderer and would require an additional sandbox-escape to fully compromise the host - the 8.8 does not represent full system takeover on its own. No conflicting data was observed, but note the SSVC total technical impact and the browser's ubiquity mean this should still be patched on the vendor's schedule despite the low EPSS. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that drives Skia into a use-after-free, then lures a victim running an unpatched Chrome (prior to 156.0.8078.79) to visit it. When the page renders, the freed Skia object is reused to gain arbitrary code execution within the renderer sandbox. No public exploit is identified at time of analysis, and low complexity (AC:L) with only passive user interaction (UI:R) makes drive-by delivery practical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Use-after-free in Skia, Chrome's graphics rendering library, lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 156.0.8078.79. The attack is a drive-by or malicious-link scenario requiring only that the target browses to attacker-controlled content (UI:R), with no credentials or non-default configuration needed; code execution remains confined to the renderer sandbox, so host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis, CISA KEV does not list the issue, and EPSS is low at 0.20% (10th percentile), though the vendor rates the flaw High severity and SSVC assigns total technical impact, yielding an overall priority of remediating this week rather than an emergency response.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.79; upgrade to that build or later, as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html (mirrored at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html), with technical detail at https://issues.chromium.org/issues/577403270. Because Chrome's updater stages code in the background, the browser must be relaunched before the fixed build is actually running, so fleets should confirm the reported version rather than assuming an automatic update has taken effect. Per the supplied assessment, patched builds are not affected and no additional workaround is documented by the vendor; the practical exposure window is limited to users still on builds earlier than 156.0.8078.79, and any residual risk from this bug alone is bounded by the renderer sandbox, since host-level compromise would require a separate sandbox-escape chain. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so remediation can follow the standard this-week cadence rather than emergency out-of-band handling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skia is the open-source 2D graphics engine embedded in Chromium and Chrome, responsible for rasterizing and compositing page content, images, canvas operations and GPU-accelerated drawing paths. This is a CWE-416 use-after-free, meaning a heap object is freed while a reference to it is still reachable and later dereferenced, which in a graphics engine can yield attacker-influenced memory corruption and, under the right heap layout, control-flow hijacking inside the renderer process. The specific allocation, object type and code path that trigger the flaw are not described in the available sources; the advisory only states that a crafted HTML page is the delivery vehicle. Because exploitation is described as occurring inside the sandbox, the immediate blast radius is the renderer (arbitrary code with the privileges of the Chrome renderer, plus availability impact via crashes), and full device compromise would require a second, independent sandbox-escape bug. The vulnerable code is fixed in the Chrome 156.0.8078.79 stable build; other Chromium-based products that embed the same Skia revision would need their own vendor-confirmed updates, which are not enumerated in the supplied data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but requiring the user to visit (UI:R); S:U because execution stays within the renderer sandbox, with high C/I/A per the RCE description.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.79 contain a high-severity use-after-free vulnerability in the Skia graphics library that could allow an attacker to execute code within the browser's sandbox when a user visits a malicious webpage. While no active exploitation has been observed, the flaw poses a risk to workforce productivity and data confidentiality if left unpatched. Leadership should prioritize patching this week to maintain the security posture of the organization's browsing environment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB