EUVD-2026-116520
GHSA-mq3h-73fr-hmw7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitChrome loads malicious XML/HTML content
-
ExecutionTrigger flaw in rendering
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-controlled web page containing crafted content (UI:R / user interaction), making this a drive-by/social-engineering vector rather than a zero-click attack. No authentication is required (PR:N) and the attack is network-delivered against default Chrome configurations prior to 157.0.8103.38. The key limiting factors are: (1) a user must be induced to open the malicious page, and (2) resulting code execution is confined to the renderer sandbox (scope Unchanged), so host compromise would require an additional, separate sandbox-escape vulnerability. SSVC rates this Automatable: no, reflecting that reliable, mass drive-by exploitation is not established from the available data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction - the victim must load a crafted HTML page. However, the description explicitly scopes code execution to 'inside the sandbox,' and scope is Unchanged (S:U), so the immediate impact is confined to the renderer process rather than the host; full system compromise would require chaining an additional sandbox-escape bug not covered here. The decision signals temper the raw score: SSVC reports Exploitation: none and Automatable: no (drive-by requires a user to open a page), with Technical Impact: total within the sandboxed component. No EPSS score was provided and the vulnerability is not on CISA KEV, consistent with no confirmed in-the-wild use. The vuln.today priority is 'this_week,' not an emergency, which aligns with a patched, not-yet-exploited high-severity browser bug. Net: a genuine high-severity issue warranting prompt patching in the normal Chrome update cycle, but the sandbox containment and absence of exploitation/automation signals place it below drive-by full-RCE emergencies. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted XML content and lures a victim to visit it (e.g., via phishing or a malvertised/compromised site). When Chrome prior to 157.0.8103.38 parses the content, the flaw is triggered and the attacker can potentially execute arbitrary code within the renderer sandbox; no public working exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 157.0.8103.38, where improper adherence to coding standards in XML handling (CWE-710) lets a remote attacker who convinces a victim to load a crafted HTML page achieve high confidentiality and integrity impact within the browser's sandboxed process. The flaw is network-reachable, low complexity and requires no authentication, but it is gated by user interaction (UI:R) and its scope is Unchanged, so host-level compromise would need a separate sandbox escape. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and Google has released a fixed build (157.0.8103.38); the vuln.today priority places remediation in the this_week window.
RemediationAI
Upgrade Google Chrome to 157.0.8103.38 or later through the stable channel; this is the vendor-released patch and the only complete fix identified in the available sources, distributed via the Chrome release advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html. Confirm the installed version from chrome://settings/help or the browser's version endpoint and verify the build reports 157.0.8103.38 or higher, then track fleet rollout against that floor - remediation is scheduled in the this_week window per the vuln.today priority. Because exploitation requires the victim to load a crafted HTML page, residual exposure is concentrated in users who browse untrusted content, but the supplied sources state no specific interim workaround (such as disabling an XML-related feature) and do not describe mitigation beyond updating, so no partial mitigation should be represented as equivalent to patching. Review the engineering ticket at https://issues.chromium.org/issues/566313798 for any additional detail Google releases as the fix matures, and note that successful exploitation is confined to the renderer sandbox, meaning the patch also removes the initial-access primitive needed for a chained sandbox-escape attack.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is tracked as CWE-710 (Improper Adherence to Coding Standards), applied here to XML processing inside Chrome. Rather than a single named memory-safety primitive, this class covers deviations from required coding conventions in the XML-handling code path, and the specific defective routine and the exact way the flaw is triggered are not described in the available sources. What the evidence does establish is the delivery and containment model: the attack is delivered over the network (AV:N) at low complexity (AC:L) with no privileges required (PR:N), and the CVSS vector's UI:R metric records that the victim must be induced to load an attacker-crafted HTML page - a drive-by or social-engineering vector, not a zero-click one. The scope metric is Unchanged (S:U), which is consistent with the vendor description that code execution is confined to the renderer sandbox; escaping to the operating system would require an additional, independent sandbox-escape vulnerability. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is an unbounded wildcard covering all Chrome builds below the fixed release, and the vendor rates the issue Chromium security severity: High.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable, no auth, but a user must open a crafted page (UI:R); code runs within the renderer sandbox so scope is Unchanged with high C/I/A on that component.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity code execution vulnerability within the browser's renderer sandbox. While it requires user interaction (e.g., visiting a malicious page), successful exploitation could allow an attacker to read or modify sensitive data within the browser process, affecting users across the organization who rely on Chrome for web access.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB