EUVD-2026-100629
GHSA-cfcv-cjw8-r6j8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
DeliveryServe crafted HTML to Chrome
-
ExploitTrigger use-after-free in Core
-
ExecutionEscape the renderer sandbox
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to load a crafted HTML page in an affected Google Chrome build prior to 155.0.8059.79 (UI:R) - no authentication (PR:N) and no special non-default Chrome configuration are needed; the triggering surface is the browser's Core component rendering attacker-supplied web content. The primary limiting factor is the required user action of navigating to or opening the malicious page; there is no persistence or privilege prerequisite. Note that the description claims code execution outside the sandbox from a single Core use-after-free, which realistically may still require a reliable heap-grooming/UAF-reclaim primitive, and CISA SSVC rates it Automatable: no, implying exploitation is not trivially mass-scalable. Platform caveat: description says Android while the vendor reference is a desktop update - confirm the affected platform. |
| Impact | This is a genuinely high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw whose scope change (S:C) reflects the stated ability to execute code OUTSIDE the Chrome sandbox - a worst-case outcome for a browser bug. Chromium rated it Critical, and the description claims full sandbox escape via a single Core use-after-free, which is unusually severe (such escapes normally require chaining a renderer bug with a separate sandbox-escape primitive). However, the exploitation signals temper urgency: CISA KEV is not indicated (no active exploitation), no public POC is referenced, and CISA SSVC scores Exploitation: none and Automatable: no, while confirming Technical Impact: total. The one sobering limiter is UI:R - a victim must open a crafted page - but for a web browser that is a routine, low-friction condition. Net: high theoretical and practical severity in a ubiquitous product, but no evidence of exploitation yet, so treat as urgent-patch rather than active-incident. Note a data conflict to verify: the description says 'on Android' yet the only vendor reference is a 'Stable Channel Update for Desktop' blog post - confirm the affected platform with Google before scoping. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers a use-after-free in Chrome's Core component when rendered. A victim running an affected Chrome build (prior to 155.0.8059.79) visits the page, and the attacker reclaims the freed memory to corrupt state and, per the advisory, execute arbitrary code outside the browser sandbox. No public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.79 or later, per the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html), and restart the browser so the new build is actually loaded - Chrome updates frequently install in the background without taking effect until all browser processes are restarted, so verify the running version (chrome://version) after updating. On Android, updates are distributed through the Google Play Store; on desktop, through the built-in Chrome updater or the vendor's enterprise MSI/PKG channels, and managed fleets can force the version floor via update policy. Because the flaw is reached through rendering attacker-supplied HTML, there is no practical feature toggle that cleanly removes the attack surface without severely degrading the browser, and a UAF in Core is not mitigated by typical content-blocking controls; the meaningful compensating controls are to constrain browsing to trusted sites and enforce update compliance until 155.0.8059.79 is deployed, and to consider a different, fully patched browser for high-risk browsing on endpoints that cannot be updated. If the platform caveat noted above matters for your environment, confirm with the vendor advisory which platform and channel the fix targets before treating desktop and Android as covered by the same build number.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-416 (Use After Free), a memory-corruption flaw in Google Chrome's "Core" component. In this class of bug, a heap object is freed while a dangling reference to it remains; attacker-controlled web content then causes the browser to reuse that memory region, letting the attacker influence the contents of the freed allocation and redirect execution flow. Achieving reliable code execution from a UAF typically requires a heap-grooming or reclaim primitive rather than simply visiting a page. The CVSS vector's S:C (scope change) and the description's claim of code execution "outside the sandbox" indicate the impact crosses Chrome's renderer sandbox boundary, which is what elevates this to Critical Chromium severity and a 9.6 base score. The triggering surface is the rendering of attacker-supplied web content in an affected Chrome build, which matches the AV:N/PR:N/UI:R vector: no authentication and no non-default configuration is required, but the victim must navigate to or open the crafted page. CISA's SSVC assessment rates Automatable: no, indicating exploitation is not trivially mass-scalable. CPE data was not supplied, so affected coverage is derived from the vendor advisory and EUVD version range rather than explicit CPE strings. Because the description names Android while the referenced vendor advisory is the desktop stable-channel release, the underlying build/platform should be verified before scoping.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote web content with no auth (AV:N/PR:N) but needs the victim to open a page (UI:R); S:C because code executes outside the sandbox, with total C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome builds prior to 155.0.8059.79 contain a critical use-after-free that could allow an unauthenticated remote attacker to execute code outside the browser sandbox when a user loads a crafted HTML page. Because Chrome is widely deployed across the workforce, a successful exploit could lead to endpoint compromise, data exposure, or lateral movement, making prompt remediation a leadership priority despite no public exploit identified at time of analysis and a vendor patch being available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB