EUVD-2026-100645
GHSA-8q6r-6jvp-32gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryServe crafted HTML media content
-
ExploitTrigger use-after-free in Media component
-
ExecutionExecute arbitrary code in renderer
-
ImpactAttacker controls sandboxed renderer process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Chrome (UI:R) that exercises the vulnerable Media code path - there is no authentication requirement (PR:N) and no non-default configuration needed, since media handling is core browser functionality. The key limiting factors are: (1) required user interaction - the target must visit or render the malicious page; and (2) code executes only inside the renderer sandbox (S:U), so meaningful host-level compromise requires chaining a separate sandbox-escape vulnerability. Affected builds are Chrome versions prior to 155.0.8059.79; updated builds are not exploitable. |
| Impact | The available signals are largely consistent and point to a genuine but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page) and does NOT change scope. Critically, the description states code executes 'inside the sandbox' (S:U), so this is renderer-level compromise that still needs a separate sandbox-escape chain to reach the host OS. SSVC tempers urgency: Exploitation=none and Automatable=no, meaning CISA observes no exploitation and no reliable mass-automation, though Technical Impact=total reflects full renderer control. There is no CISA KEV listing and no POC referenced, so this is not confirmed exploited. Net: a real patching priority for any Chrome fleet given ubiquity and the ease of drive-by delivery, but not a drop-everything zero-day absent exploitation evidence. One minor tension to note: the Tags include 'Denial Of Service' while the description and CVSS emphasize arbitrary code execution - DoS is at most a secondary effect of the use-after-free, not the primary impact. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious media content and lures a victim into visiting it (malvertising, phishing link, or watering hole). When Chrome's Media component processes the crafted content, a use-after-free is triggered, letting the attacker execute arbitrary code within the renderer sandbox; full host compromise would require chaining an additional sandbox escape. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
RemediationAI
Vendor-released patch: upgrade Google Chrome to version 155.0.8059.79 or later - this is the fixed version published in both the Stable and Extended Stable channel advisories, so desktop users should force an update check via chrome://settings/help and restart the browser, while enterprise administrators should push the fixed build through their normal update mechanism (for example Google Update / managed Chrome policies) and verify the reported version on endpoints rather than assuming auto-update completed. There are no practical configuration workarounds that remove the risk, because media handling is core browser functionality and disabling it would break normal web use; the closest compensating controls are browser-level isolation features that already constrain the blast radius - the renderer sandbox and Site Isolation limit code execution to the sandboxed renderer (S:U), which means an attacker must additionally chain a separate sandbox-escape vulnerability to reach the host. Administrators who cannot immediately update can reduce exposure by restricting browsing of untrusted sites through policy allowlists, delivering high-risk browsing through a disposable or virtualized environment, and monitoring for repeated renderer crashes in the Media process, which is the most likely signal of attempted exploitation. Detection and patching detail is available in the Chromium issue https://issues.chromium.org/issues/565742182 and the release advisories at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html and https://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, in Chromium's Media subsystem - the pipeline that handles media element loading, demuxing and codec processing of attacker-supplied content inside the renderer process. Chrome releases label this Chromium security severity High, and Google classifies it as a memory-corruption issue that can be steered toward remote code execution; the accompanying tags (RCE, Use After Free, Memory Corruption, Denial Of Service) reflect that a benign outcome is at minimum a renderer crash. Exploitation is driven purely by web content: the victim's browser must parse and render a crafted HTML page that exercises the vulnerable Media code path, giving PR:N with UI:R. Because the vulnerability lives in the renderer's media handling rather than in the browser kernel or IPC layer, the attacker's immediate execution context is the sandboxed renderer (S:U); host compromise would demand a second, independent sandbox-escape vulnerability. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H therefore describes full confidentiality, integrity and availability impact inside that sandboxed context rather than on the underlying operating system.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a crafted page with no privileges (AV:N/PR:N) but needs the user to visit it (UI:R); scope unchanged as code stays in the sandbox (S:U), with full renderer C/I/A loss.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.79 contain a high-severity use-after-free vulnerability in the Media component, enabling remote code execution within the browser's renderer sandbox if a user visits a malicious webpage. While no public exploit identified at time of analysis, the widespread enterprise use of Chrome means unpatched endpoints remain a significant risk, requiring prioritized remediation to prevent potential credential theft or data exfiltration from compromised browser sessions. Leadership should ensure all Chrome installations are updated to version 155.0.8059.79 or later to eliminate this flaw.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB