EUVD-2026-116398
GHSA-qr7p-49mm-rhjf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Aura
-
ExecutionReuse freed object for control
-
ImpactExecute arbitrary code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has FIRST compromised Chrome's renderer process through a separate vulnerability; this use-after-free in the Aura component is then triggered via a crafted HTML page that the victim must load (UI:R), making it a sandbox-escape stage of a multi-bug chain rather than a standalone remote attack. Limiting factors: the prerequisite renderer compromise, the required user interaction of visiting attacker-controlled content, high attack complexity (AC:H) in the CVSS vector, and the fix being limited to Chrome builds before 157.0.8103.38. The only complete remediation stated by the vendor is updating to 157.0.8103.38 or later. |
| Impact | This is a real but second-stage risk rather than a standalone drive-by. The official CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) reflects a network vector with high attack complexity, user interaction (visiting a crafted page), and a scope change - consistent with a renderer-sandbox escape (CWE-416 use-after-free in Aura). However, the description explicitly states the attacker must have ALREADY compromised the renderer process, so PR:N somewhat understates the real precondition: this bug is useful only as the second link in an exploit chain, not as an initial access vector on its own. The decision signals point the same way as this caveat: SSVC reports Exploitation=none, Automatable=no, Technical Impact=total, and vuln.today assigns 'this_week' (not act_now/emergency). There is no CISA KEV listing and no EPSS score supplied, so widespread or automated exploitation is not indicated. No working exploit is referenced. Net: a high-severity, total-impact memory-corruption bug in an ubiquitous product that warrants prompt patching on the stated weekly cadence, but the chain-dependency (needs prior renderer compromise) and high complexity make it a priority patch rather than a fire-drill. EPSS and KEV data are absent; treat the automatable=no / exploitation=none SSVC values as the best current exposure signal. |
| Exploit ScenarioDerived | An attacker who has already exploited a separate renderer-process bug lures or redirects the victim's Chrome browser to a crafted HTML page that triggers the use-after-free in the Aura component, then leverages the freed-object reuse to execute arbitrary code outside the renderer sandbox on the host. No public exploit or PoC is referenced for this specific flaw, and exploitation requires both user interaction (page visit) and a pre-existing renderer compromise, matching the high attack complexity in the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Sandbox escape via a use-after-free in Google Chrome's Aura component affects builds prior to 157.0.8103.38 and can let a remote attacker who has already compromised the renderer process potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. The CVSS vector is 8.3 with PR:N but AC:H and UI:R, and the independent assessment emphasizes that this is a second-stage, multi-bug-chain risk rather than a standalone drive-by. No public exploit was identified at time of analysis, and SSVC records exploitation as none; the vendor-released fix is Chrome 157.0.8103.38 or later.
RemediationAI
Vendor-released patch: update Google Chrome to 157.0.8103.38 or later; the vendor states that updating is the only complete remediation, and the independent assessment confirms the fix is limited to Chrome builds before 157.0.8103.38. Apply the update through Chrome's standard update mechanism and restart the browser so the new build is active, then verify the version is 157.0.8103.38 or higher. The vendor advisory is at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html; no alternative complete mitigation is stated in the available sources, and this should be prioritized within the current this_week patch cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Aura, Chrome's UI and window-management layer, with a CPE of cpe:2.3:a:google:chrome. According to the supplied assessment, exploitation requires that the attacker first compromise Chrome's renderer process through a separate vulnerability; the Aura use-after-free is then triggered via a crafted HTML page that the victim must load. This makes it a sandbox-escape stage of a chained attack rather than a standalone remote compromise, consistent with the CVSS scope change (S:C) and high attack complexity (AC:H). The sources do not describe the specific Aura object or the precise trigger sequence beyond the crafted HTML page and the prerequisite renderer compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Crafted HTML over the network (AV:N, UI:R) with high complexity given the required prior renderer compromise (AC:H); sandbox escape yields scope change (S:C) and full host impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity sandbox escape that could allow an attacker who has already breached a renderer process to execute code beyond the browser sandbox. This is a second-stage risk requiring an existing compromise plus user interaction, so the practical threat to the organization is elevated but conditional. Leadership should care because Chrome is widely deployed, and unpatched browsers leave a residual escalation path open in the event of an initial compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB