EUVD-2026-100650
GHSA-cg4q-7q7h-cp5v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious media content
-
ExecutionTrigger use-after-free in Media component
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 155.0.8059.79 to load attacker-controlled web content (UI:R) that exercises the vulnerable Media component to trigger the use-after-free; no authentication or special privileges are needed (PR:N) and default configurations are affected. Key limiting factors: (1) user interaction is mandatory - the victim must open the crafted page; (2) resulting code execution is confined to the renderer sandbox (S:U), so meaningful host compromise additionally requires a separate sandbox-escape vulnerability; and (3) patched/auto-updated Chrome installs at or above 155.0.8059.79 are not affected. |
| Impact | Signals are moderately consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, with high confidentiality/integrity/availability impact. However, the description explicitly scopes code execution to 'inside the sandbox' - meaning a separate sandbox-escape would be needed for full host compromise, which the unchanged scope (S:U) correctly reflects. Exploitation-likelihood signals are LOW and mutually reinforcing: EPSS is 0.21% (10th percentile), SSVC reports Exploitation: none and Automatable: no (though Technical Impact: total), and there is no CISA KEV listing and no public exploit identified. This is the typical profile of a freshly patched Chromium memory-safety bug: high theoretical impact but no evidence of real-world weaponization at analysis time. Priority is driven by the ubiquity of Chrome and the ease of browser-driven delivery rather than by any active-exploitation signal. No major conflicts between sources; the main nuance to verify is the sandbox-containment qualifier, since 'execute arbitrary code' in isolation could be read as full host RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing media content crafted to trigger a use-after-free in Chrome's Media component; when a victim running a version prior to 155.0.8059.79 visits it, the attacker gains arbitrary code execution within the browser's sandboxed renderer process. No public exploit code has been identified, and full host compromise would require chaining this with a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
RemediationAI
Apply the vendor fix: Google released patched builds in the Stable Channel Update for Desktop, so upgrade Google Chrome to 155.0.8059.79 or later - on managed fleets push the update through your software-deployment tooling, and on unmanaged devices let Chrome's auto-updater run or manually check chrome://settings/help and restart the browser so the new binary actually loads. Android and other Chromium-derived browsers should be updated as their vendors publish equivalent fixes. Because the code execution is confined to the renderer sandbox, host-level compromise additionally requires a sandbox-escape chain, so preserving sandboxing (do not run with --no-sandbox and keep OS-level browser sandboxing enabled) is a meaningful compensating control with essentially no downside on modern platforms; restricting browsing to trusted sites and blocking untrusted HTML attachments or redirect chains reduces exposure but trades off user productivity and is only partially effective against a browser flaw. There is no practical way to disable the Media component as a workaround without breaking normal browsing, and Google does not publish version-specific runtime mitigations for this class of defect, so patching - combined with enforced update policies and prompt browser restarts - is the recommended course. Reference: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html (fixed version 155.0.8059.79).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free (also tagged as memory corruption, RCE, and denial of service) located in Chromium's Media component, the code that handles audio/video decoding, demuxing, and playback elements. A use-after-free occurs when an object is freed but a dangling pointer to it is later dereferenced; in a media pipeline this can happen when playback state, buffers, or codec-related objects are torn down while a reference is still in flight, letting an attacker influence heap layout and redirect execution. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the attack is network-delivered but requires the victim to open a crafted page, and the resulting code execution is scoped to the renderer sandbox (S:U) - meaningful host compromise would require chaining a separate sandbox-escape vulnerability. The underlying Chromium bug is tracked in the Chromium issue tracker (issues.chromium.org/issues/568719352) and was reported by chrome-cve-admin@google.com, matching Google's standard restricted-disclosure workflow for high-severity memory-safety bugs.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but requires the victim to load it (UI:R); sandboxed code execution keeps scope unchanged (S:U) with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.79 are affected by a high-severity vulnerability that could allow an attacker to execute malicious code within the browser's sandbox, potentially leading to data exposure or further compromise of user systems. While no public exploit identified at time of analysis, the widespread use of Chrome across the organization means that unpatched endpoints remain at risk. Leadership should ensure that all Chrome installations are updated promptly to mitigate this threat.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB