EUVD-2026-113427
GHSA-wjwf-6wgh-pvxq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in FileSystem component
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Chrome prior to 156.0.8078.79 to visit an attacker-controlled or compromised web page that serves a crafted HTML payload targeting the FileSystem component - this user interaction (UI:R) is the primary limiting factor. No authentication is required (PR:N). The key constraint on real-world impact is that resulting code execution is confined to the renderer sandbox (S:U, explicitly 'inside the sandbox'); full host compromise additionally requires a separate sandbox-escape vulnerability. Updating to 156.0.8078.79 or later is the vendor-provided fix. |
| Impact | Signals are moderately consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes remote, low-complexity, unauthenticated exploitation that requires user interaction (visiting a crafted page), with high confidentiality/integrity/availability impact. Critically, the description states code execution occurs 'inside the sandbox' and Scope is Unchanged (S:U) - meaning this flaw alone does not escape Chrome's renderer sandbox, so standalone impact on the host is bounded unless chained with a separate sandbox-escape bug. EPSS is low (0.20%, 10th percentile) and SSVC reports Exploitation: none, Automatable: no, Technical Impact: total; these agree that there is no observed exploitation and that mass, automated attacks are not expected, even though a successful exploit yields total impact on the renderer process. There is no CISA KEV listing and no confirmed public exploit. The low EPSS alongside 'total' technical impact is not a contradiction here: impact severity is high but likelihood of in-the-wild use is currently low, consistent with the vuln.today 'this_week' priority (patch promptly, not an emergency). No key data is strongly conflicting; the main caveat is that the sandbox confinement meaningfully reduces real-world risk relative to the raw 8.8 score. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing malicious content that triggers the FileSystem memory-corruption bug when a victim using a vulnerable Chrome build visits it. Successful exploitation yields arbitrary code execution confined to Chrome's renderer sandbox; achieving host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Memory corruption in the FileSystem component of Google Chrome prior to 156.0.8078.79 allows remote attackers to potentially execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. Affected users are those running any Chrome build below 156.0.8078.79; no authentication is required but successful exploitation depends on user interaction (visiting an attacker-controlled or compromised page). No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile), although the vendor rates the Chromium security severity as High and SSVC assigns total technical impact.
RemediationAI
Update Google Chrome to version 156.0.8078.79 or later, which the vendor provides as the complete fix; the same release announcement (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html) documents the stable channel update, and administrators should also confirm the corresponding Chromium-based builds inherit the fix. Because exploitation requires a victim to open a crafted HTML page, reducing exposure until upgrades complete means restricting browsing to trusted sites and keeping Chrome's automatic update mechanism enabled so the fixed build is applied without user action; neither control removes the flaw itself, and updating to 156.0.8078.79 is the only complete remediation identified in the available data. Note that any code execution achieved through this bug is confined to the renderer sandbox, so hosts with additional sandbox-escaping exposure should be patched with priority.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a memory-corruption bug (CWE-119, improper restriction of operations within the bounds of a memory buffer) located in Chrome's FileSystem implementation, the renderer-side code that backs the File and FileSystem web APIs. A crafted HTML page can drive that code into an out-of-bounds memory condition, which the attacker may then leverage for code execution. Crucially, the vendor description scopes the impact to code execution 'inside the sandbox', meaning a compromise lands within Chrome's renderer sandbox; escaping to the host operating system would require chaining a separate sandbox-escape vulnerability. The trigger specifics beyond a crafted HTML page are not described in the available sources, and the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome builds before the fixed release. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network-delivered content, no privileges required, mandatory user interaction, and high confidentiality and integrity impact within the single affected security scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must visit it (UI:R); code execution stays inside the renderer sandbox so Scope is Unchanged, with high renderer-process C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.79 contain a high-severity memory corruption flaw in the FileSystem component that could let an attacker execute code within the browser's renderer sandbox. Because exploitation only requires a user to visit a malicious or compromised webpage, the organization's entire Chrome user base is exposed to potential malware infection or data compromise. Leadership should prioritize patching given the vendor's high severity rating and the low barrier to exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB