EUVD-2026-100632
GHSA-29rr-97r4-9hj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in renderer
-
ExecutionReclaim freed object memory
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim running Chrome Desktop on a version prior to 155.0.8059.79 to open or be redirected to an attacker-controlled crafted HTML page (UI:R) - there is no server-side or passive exposure. No authentication or special privileges are needed (PR:N). The key limiting factor is that per the vendor description arbitrary code execution is confined to the renderer sandbox, so without an additional sandbox-escape the attacker does not gain host-level control; required user interaction (navigation to the malicious page) further constrains large-scale automated exploitation, consistent with SSVC Automatable: no. |
| Impact | This is a genuine high-priority patch item but not an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H → 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that only requires a victim to open a crafted HTML page - a realistic condition for a browser. Signals diverge on urgency, however: the CISA SSVC framework reports Exploitation: none and Automatable: no, meaning no observed exploitation and no reliable mass-automation path (each hit needs a user to visit a page), even though Technical Impact is rated total. There is no CISA KEV listing and no public exploit was provided in the input, so this is 'no public exploit identified at time of analysis.' A critical qualifier the description states explicitly is that code execution occurs 'inside the sandbox' - i.e., within the renderer process, not on the host - so absent a chained sandbox-escape this yields renderer compromise rather than full system takeover, which tempers the 8.8 in practice. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be factored in; this is a data gap rather than evidence of low risk. Net: patch promptly given Chrome's enormous footprint and the trivial delivery, but the no-exploitation/non-automatable SSVC reading and the sandbox-contained impact argue against treating it as actively-exploited-grade urgency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing specially crafted HTML/JavaScript that triggers a use-after-free in Chrome's Desktop build; when a victim on a version prior to 155.0.8059.79 visits it, the freed-then-reused object is manipulated to achieve arbitrary code execution within the renderer sandbox. No public proof-of-concept was identified in the provided data, and successful exploitation requires the user to navigate to the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.79 - update immediately via the built-in updater (chrome://settings/help) or by pushing the fixed build through enterprise software distribution, remembering that the browser must be fully restarted before the new binary is in effect. Organizations on the extended stable channel should apply the matching extended stable update referenced in the same October 2026 advisory set (https://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html and https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html). Because the flaw is only reachable by navigating to attacker-controlled content and the resulting code execution stays inside the renderer sandbox, interim compensating controls are limited: enforce auto-update via policy so no endpoint lags behind 155.0.8059.79, and, where a maintenance window delays patching, restrict high-risk browsing to a managed virtualized or disposable browser session and tighten URL/extension filtering - with the trade-off that these measures reduce productivity and do not remove the underlying memory-corruption bug. Keeping Chromium's site isolation enabled (the default) limits cross-site data exposure if the renderer is compromised, but it is not a substitute for patching. No vendor-released workaround other than the update is documented; per available intelligence there is no public exploit code, so the primary risk driver is the fraction of unpatched Chrome Desktop endpoints rather than active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, Use After Free - a heap memory-corruption class in which Chrome's Desktop component continues to reference a previously freed object, allowing an attacker to influence the contents of the reclaimed memory through heap grooming from a crafted HTML page. The vulnerability sits in the browser's multi-process architecture: the malicious page is parsed and rendered in a low-privilege renderer process, and the arbitrary code execution achieved by the attacker runs inside that sandboxed process rather than at host privilege level. This is why the impact is high-confidentiality/integrity/availability within the browser context but does not by itself constitute a full system compromise; a renderer-to-browser or renderer-to-OS sandbox escape would be needed to elevate further. Chromium classifies the issue as high severity, and the affected build train is Chrome Desktop before 155.0.8059.79, with the flaw tracked in Chromium issue 540499008 and reflected in ENISA EUVD-2026-100632.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page with no privileges but required user navigation (UI:R); high C/I/A reflect code execution, though impact is sandbox-contained so scope is Unchanged.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome Desktop versions prior to 155.0.8059.79 contain a high-severity use-after-free vulnerability that can allow an attacker-controlled webpage to execute code within the browser's renderer sandbox, affecting users who browse to or are redirected to a crafted page. Although exploitation requires user interaction and remains confined to the sandbox unless chained with a separate sandbox escape, Chrome's broad workforce deployment makes prompt patching important to reduce follow-on risk. Leadership should prioritize remediation because a successful chain could lead to broader endpoint compromise, data exposure, or business disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB