EUVD-2026-100659
GHSA-3h2v-c7gf-8wp8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Media component
-
ExecutionReuse freed object to control memory
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to actively load an attacker-controlled HTML page in a vulnerable Chrome build (any version prior to 155.0.8059.79); the flaw lives in the Media component, so content exercising media handling is the trigger surface. The CVSS vector's UI:R confirms mandatory user interaction (visiting/rendering the page) - there is no zero-click path. The key limiting factor is scope: code execution is contained within the renderer sandbox (S:U), so by itself it does not compromise the host OS without a separate sandbox-escape bug. Chrome's automatic update mechanism further limits the exposure window for most deployments. |
| Impact | This is a genuine patch-priority item but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a low-complexity, network-reachable, unauthenticated flaw requiring only that a victim load a crafted HTML page - trivial to satisfy via a malicious or compromised website. Impact metrics are maximal (C:H/I:H/A:H), consistent with a CWE-416 use-after-free in the Media component yielding arbitrary code execution. However, several signals temper the raw 8.8 score: the description explicitly scopes code execution to INSIDE the renderer sandbox (S:U, no scope change), so standalone exploitation does not escape to the host without a second chained bug; CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (though Technical Impact 'total'); the CVE is NOT in CISA KEV; and no EPSS score or public POC was provided. These are consistent with each other - no conflict - and collectively indicate a serious-but-not-actively-exploited browser memory-corruption bug. The dominant mitigating factor not captured by CVSS is Chrome's rapid auto-update: most installs will patch to 155.0.8059.79 automatically within days, sharply shrinking the real-world window. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects content into a page via malvertising) that drives Chrome's Media component into a use-after-free, then uses the freed-object reuse to achieve arbitrary code execution within the renderer process when a victim simply visits the page. No public exploit was identified at the time of analysis, and because execution is confined to the sandbox, a practical real-world compromise of the host would require chaining this with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
RemediationAI
Vendor-released patch: 155.0.8059.79 - upgrade Google Chrome to 155.0.8059.79 or later, which Chrome's automatic update mechanism should deliver on restart; verify the installed build via chrome://version and force an update check through chrome://settings/help if the version lags. Organizations using the extended stable channel must apply the corresponding extended stable build referenced in the vendor advisory (http://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html), and enterprise administrators should confirm update policies allow prompt installation and prompt browser relaunches, since deferring restarts leaves the vulnerable renderer resident. No Chrome setting disables the Media component outright, so compensating controls are limited to reduction of exposure: restrict browsing of untrusted HTML content or route it through a separate, hardened browser profile, and keep Site Isolation and the renderer sandbox enabled so any exploitation remains contained (trade-off: some media-heavy and embedded-content workflows degrade, and these measures reduce but do not eliminate risk). Blocking or disabling JavaScript and media playback on untrusted sites is technically possible but breaks most modern web applications and is not a practical substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in Chrome's Media component, the subsystem responsible for demuxing, parsing, and decoding audio/video content rendered by the browser. A dangling reference to a freed media object allows heap memory to be reused under attacker influence, which in a renderer process typically converts into controlled memory corruption and ultimately code execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the attack is network-delivered, unauthenticated, low complexity, and requires the victim to render attacker-supplied content, with the resulting impact confined by scope-unchanged semantics to the renderer sandbox. Chrome's multi-process architecture and Site Isolation therefore act as the principal containment boundary: the bug by itself does not cross into the browser process or the host OS. The Media surface is attractive because it processes complex, attacker-influenced container/codec data, and Chrome's rapid release and automatic-update model shortens the practical exposure window for most users.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no privileges, but mandatory user interaction (UI:R); scope unchanged since code runs within the sandbox; full CIA impact within that renderer context.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop versions prior to 155.0.8059.79 are affected by a use-after-free vulnerability in the Media component that permits remote code execution inside the renderer sandbox. No public exploit identified at time of analysis, but the flaw is remotely triggerable with user interaction and could lead to compromise of browser sessions; host compromise requires chaining with a separate sandbox escape. Vendor-released patch: 155.0.8059.79. Leadership should prioritize patching across the enterprise to protect users and data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB