EUVD-2026-116399
GHSA-63wx-wjmv-9487
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers DOM use-after-free
-
ExecutionReclaim freed object to control memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running an affected Chrome version (any build prior to 157.0.8103.38) to actively load attacker-controlled HTML in the browser - this user interaction (UI:R: clicking a link or visiting a malicious/compromised/malvertising page) is the primary limiting factor; it cannot be triggered without the user opening the page. No authentication is required (PR:N) and no special non-default Chrome configuration is indicated by the description. The key containment factor is that the resulting code execution is confined to the renderer sandbox per the description; converting this into host-level compromise would require a separate sandbox-escape not included in this CVE. |
| Impact | This is a genuine high-priority browser flaw but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) in Chrome's DOM, requiring only that a victim load a crafted HTML page (UI:R). Signals are broadly consistent and point to a real but not actively-exploited issue: SSVC records Exploitation: none and Automatable: no, with Technical Impact: total, and the vuln.today Decision label is 'this_week' rather than act_now/emergency. No CISA KEV listing and no EPSS score are provided, and no public exploit or proof-of-concept is present in the references (the chromium issue tracker link is a restricted bug entry, not exploit code). The important nuance to flag explicitly: the description states code execution occurs 'inside the sandbox' (scope reported S:U), so by itself this does not grant host compromise - full host RCE would require chaining with a separate sandbox-escape, which is not covered by this CVE. Given Chrome's ubiquity and the historically high rate at which renderer UAFs are weaponized, prompt patching is warranted, but current evidence does not support treating it as an in-the-wild zero-day. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the DOM use-after-free, then lures a Chrome user (via link, ad, or malvertising) to visit it. When the victim loads the page, the freed-then-reused object is manipulated to achieve arbitrary code execution within the renderer sandbox. No public exploit or proof-of-concept is identified at time of analysis; the specific object and trigger sequence are not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Use-after-free in Chrome's DOM implementation lets a remote attacker who gets a victim to load a crafted HTML page run arbitrary code inside the renderer sandbox. Every Chrome build before 157.0.8103.38 is affected; the user must actively open the attacker's page (UI:R), but no credentials or non-default configuration are needed (PR:N). Exploitation is confined to the sandbox per the advisory, so host compromise would need a separate sandbox escape; no public exploit or active exploitation is recorded (SSVC exploitation: none) and vendor patches are released, making this a genuine high-priority browser fix rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 157.0.8103.38 or later via the Stable channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html; enterprise fleets should push the update through their normal Chrome management channel and verify the reported version. Until that rollout completes, the practical exposure reduction is to keep users off untrusted and malvertising-prone pages, since the bug needs a crafted HTML page loaded in an affected browser, alongside standard renderer sandbox enforcement which limits the impact to the sandboxed process. Note the residual risk after upgrading is low because the advisory records no exploitation (SSVC exploitation: none) and no public exploit was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's DOM layer, the in-renderer object model that parses and maintains the document tree for every loaded page. A memory object is freed while still referenced, so subsequent DOM operations touch reclaimed memory; with heap layout control an attacker can redirect execution within the renderer process. Chrome's multi-process architecture means that primitive lands in the sandboxed renderer, and escalating to the OS requires a second, independent sandbox-escape bug. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects that although the trigger is network-delivered HTML and requires no privileges, a victim must load the page; the sources do not describe the specific DOM API or object lifetime involved, and the trigger is not described in the available sources. CPE cpe:2.3:a:google:chrome confirms the affected product line, with Chromium security severity High.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to load it (UI:R); code runs within the sandbox so scope is unchanged (S:U) with high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity use-after-free vulnerability that could allow an attacker to execute arbitrary code within the browser's renderer sandbox when a user visits a malicious webpage. This affects all employees using unpatched Chrome, but the confined sandbox limits the blast radius to the browser process. Leadership should prioritize rapid patch deployment to prevent targeted attacks that could lead to data exposure or further exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB