EUVD-2026-100648
GHSA-qf8p-76rq-jcjx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryDeliver malicious JavaScript to V8
-
ExploitTrigger use-after-free in V8 engine
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Google Chrome prior to 155.0.8059.79 to load attacker-controlled HTML/JavaScript in the browser (UI:R - user must open the page), triggering the use-after-free in the V8 engine. No authentication or special privileges are needed (PR:N) and no non-default configuration is required - the vulnerable V8 engine is active in all standard Chrome installations. The primary limiting factor is that successful code execution is confined to the renderer sandbox: standalone impact does not reach the host OS without an additional sandbox-escape vulnerability. User interaction (navigating to the malicious page) is the key gating requirement. |
| Impact | This is a genuinely high-priority browser flaw, though the signals are mixed and point toward potential rather than confirmed risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated code-execution bug requiring only that a user open a crafted HTML page - a trivially achievable condition for a web browser. Memory-corruption bugs in V8 are historically among the most heavily weaponized vulnerability classes in Chrome, which raises baseline concern. However, the exploitation signals do NOT currently indicate active abuse: this CVE is not listed in CISA KEV, no POC or public exploit is referenced in the provided data, and CISA's SSVC decision framework records Exploitation=none and Automatable=no. SSVC Technical Impact=total is consistent with arbitrary code execution. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in. A critical caveat the raw CVSS score obscures: the description states code execution occurs 'inside the sandbox,' meaning this bug alone yields only renderer-process compromise - full system impact requires chaining a separate sandbox-escape vulnerability, which materially lowers standalone real-world severity below what the 8.8 score implies. Net assessment: patch promptly as part of normal Chrome update hygiene (Google ships these frequently and the fix is already available), but there is no evidence of in-the-wild exploitation at time of analysis, so this is urgent-but-not-emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript crafted to trigger the use-after-free in Chrome's V8 engine, then lures a victim to visit it (e.g., via phishing link or malvertising). When the victim's browser renders the page, the freed-then-reused object is manipulated to corrupt memory and achieve arbitrary code execution within the renderer sandbox. No public exploit code is identified in the provided data, and full host compromise would additionally require a separate sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.79 - upgrade through the browser's built-in updater (chrome://settings/help on desktop) or by deploying the 155.0.8059.79 stable packages for Windows, macOS and Linux; the fix is documented in Google's stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html and tracked in Chromium issue 568010382. For environments that cannot immediately update, the practical compensating controls all carry real trade-offs: keep Chrome's site isolation and renderer sandbox enabled, since these are what confine a successful exploit to the renderer process and force an attacker to also obtain a sandbox escape; restrict or block browsing to untrusted sites via enterprise URL allow-listing/deny-listing policy (breaks general web access); disable JavaScript by policy or extension for high-risk browsing profiles (substantially breaks most modern web applications); and enforce Chrome Enterprise policy to prevent update deferral beyond the shortest feasible window. Because no public exploit code has been identified and SSVC rates the issue as non-automatable, aggressive anti-JavaScript lockdowns are generally not proportionate, and prompt patching plus maintaining sandbox and site-isolation defaults is the appropriate response. Monitor the Chromium issue for the eventual technical write-up and re-evaluate if exploitation status changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is the open-source JavaScript and WebAssembly engine that ships inside every standard Google Chrome installation, and it is the component in which this flaw resides. The root cause is CWE-416 (Use After Free): a heap-allocated V8 object - such as a JIT-compiled code object, a JSObject, or an internal map/descriptor structure - is freed while a dangling reference to it is still reachable. Because an attacker who can influence JavaScript execution also controls substantial heap grooming and allocation timing (for example through typed arrays and ArrayBuffers), the freed slot can be reallocated with attacker-controlled contents and the stale reference then used to redirect an indirect call, yielding arbitrary code execution in the renderer process. Chromium's own security severity for this issue is High, the reported vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (network reachable, no privileges, user interaction required, high confidentiality, integrity and availability impact, scope unchanged), which is consistent with the independent assessment. The affected build is the Chrome stable desktop channel prior to 155.0.8059.79; because the vulnerable V8 code is active by default, no non-default configuration is required to be exposed. The flaw was tracked in Chromium issue 568010382 and credited via chrome-cve-admin@google.com, and, as is typical for Chrome stable-channel releases, full technical details are withheld until a majority of users have updated.
Know when Chromium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the user to open it (UI:R); code stays in the sandbox so scope is unchanged (S:U) with full renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 155.0.8059.79 contain a use-after-free flaw in the V8 JavaScript engine that allows a remote attacker to run code on any employee workstation that loads a crafted web page. Because the exposure path is ordinary web browsing rather than a specialized business application, every Chrome user in the organization is effectively in scope, making this a broad, low-effort target surface for opportunistic attackers. Exploitation is currently confined to the browser's renderer sandbox and no public exploit has been identified, but a vendor fix is available and the size of the affected install base makes prompt, verified patching the priority for leadership.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
Use-after-free in the Workers component of Google Chrome allows an unauthenticated remote attacker to execute arbitrary
Use-after-free in Google Chrome's WebAppInstalls component allows a remote, unauthenticated attacker to execute arbitrar
Remote code execution inside the renderer sandbox can be triggered in unpatched Google Chrome builds by a use-after-free
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap c
The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure, which all
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service o
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow
The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome bef
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the
Exploit-DB