EUVD-2026-100639
GHSA-rwv5-gp2p-8wqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalicious WebRTC JS triggers object free
-
ExecutionReuse dangling pointer (UAF)
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Chrome desktop build (prior to 155.0.8059.79) and to load attacker-controlled content that exercises the WebRTC subsystem - i.e., user interaction (UI:R) in the form of visiting or being redirected to a crafted HTML page is mandatory. The key limiting factor is sandbox containment: the description confirms code execution occurs inside the renderer sandbox (S:U), so without an additional sandbox-escape vulnerability the attacker does not gain host-level code execution. No authentication is required (PR:N). Patched builds (155.0.8059.79 and later) are not affected. |
| Impact | Signals are moderately consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a classic drive-by browser profile. However, the description explicitly states code execution occurs 'inside the sandbox,' which is consistent with the scope being Unchanged (S:U): absent a chained sandbox escape, impact is contained to the renderer process, materially reducing real-world severity versus a full host compromise. Exploitation posture is low: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and SSVC reports Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. SSVC Technical Impact=total reflects total compromise of the sandboxed renderer, not the host. Net: this is a routine-priority Chrome patch - patch promptly in line with normal browser update cadence, but it is not a high-real-risk, actively-exploited emergency. Note the conflicting-looking SSVC 'total' impact against S:U sandbox containment: 'total' here applies to the vulnerable (renderer) component, not the operating system. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious web page containing crafted HTML/JavaScript that abuses WebRTC to trigger a use-after-free in Chrome's renderer. When a victim using a pre-155.0.8059.79 Chrome build visits the page, the freed object is reclaimed and manipulated to achieve arbitrary code execution within the renderer sandbox. No public exploit code or active exploitation is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
RemediationAI
Upgrade Google Chrome desktop to 155.0.8059.79 or later; this is a vendor-released patch and patched builds are not affected. Administrators should verify the installed version via chrome://settings/help and use Chrome management or enterprise update policies to force the fixed release, referencing Google's stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html. If immediate patching is not possible, reduce exposure by restricting browsing to trusted sites and keeping the Chrome sandbox enabled, since the vulnerability alone yields code execution only inside the renderer sandbox; disabling sandboxing or using unsupported flags would increase risk. No public exploit was identified at time of analysis, but the patched version should still be treated as the primary mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in WebRTC, Chrome's real-time communication engine for audio, video, and data channels. A use-after-free occurs when code continues to reference an object after it has been freed, allowing an attacker who can influence object lifetime through crafted WebRTC-related HTML or JavaScript to corrupt memory and potentially redirect execution. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a remotely reachable, low-complexity bug that requires the victim to interact with attacker-controlled content, with high confidentiality, integrity, and availability impact confined to the renderer sandbox. EUVD lists the affected version as Chrome 155.0.8059.79 <155.0.8059.79; no CPE strings were provided in the input data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but victim must open it (UI:R); sandbox-contained renderer RCE keeps scope unchanged (S:U) with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome releases prior to 155.0.8059.79 contain a memory-safety flaw in the WebRTC component, meaning any employee browsing with an unpatched browser could be exposed to attacker-supplied code running inside the browser's restricted renderer process after simply loading a crafted web page. Because Chrome is installed on nearly every corporate workstation and is one of the most heavily targeted applications in the enterprise, the affected population is effectively the entire workforce, even though the sandbox confines damage to the browser rather than the underlying host. No exploitation has been observed and a fixed version is already published, so this is a broad-exposure patching obligation rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB