EUVD-2026-105418
GHSA-8ff3-qj6g-3r66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in WebUI
-
ExecutionReuse freed object for control flow
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open attacker-controlled content: a crafted HTML page rendered by Chrome's WebUI, so user interaction (UI:R) is a hard prerequisite - there is no server-side or passive network vector. No authentication or special privileges are needed (PR:N) and default Chrome configurations are affected (no non-default feature toggle named in the description). The key limiting factor is that resulting code execution is confined to the browser sandbox; converting this into host compromise requires an additional, separate sandbox-escape vulnerability. Affected scope is Chrome versions prior to 156.0.8078.47 across desktop and ChromeOS channels. |
| Impact | The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction (visiting a page) - consistent with a browser use-after-free triggered by a crafted HTML page. Two signals meaningfully temper the raw 8.8: (1) the description explicitly states code execution occurs 'inside the sandbox' and the vector keeps Scope Unchanged (S:U), so a separate sandbox-escape chain is needed for full host compromise - the standalone impact is confined to the renderer/WebUI process; (2) UI:R means exploitation is not wormable or fully automatic and depends on tricking a user. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or available exploit code - this is a High (not Critical) Chromium-rated issue that is a routine but genuine patch-priority item given Chrome's ubiquity, rather than an emergency. Missing data to note: EPSS is absent (cannot gauge statistical exploitation likelihood), and KEV status is not confirmed present, so 'no public exploit identified' reflects absence of evidence, not proof of non-exploitability. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that drives Chrome's WebUI into a use-after-free condition. When a victim running an unpatched Chrome (prior to 156.0.8078.47) visits the page, the freed object is reused to achieve arbitrary code execution within the browser sandbox. No public exploit code was identified in the provided data; full host compromise would additionally require chaining a sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's WebUI layer allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47 on desktop and ChromeOS. Successful exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw. Rated 8.8 (High by Chromium standards), the bug carries no public exploit code and no confirmed active exploitation (no CISA KEV entry) at time of analysis, and Google has shipped a fixed build.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later on all desktop and ChromeOS endpoints - Chrome's auto-update normally delivers this, but verify the installed build via chrome://version and force an update check (Relaunch to update) where it is still pending; ChromeOS administrators should confirm the corresponding stable-channel release has reached managed devices. Because the flaw requires the victim to open a crafted HTML page, interim risk reduction is possible by enforcing enterprise URL blocklisting of untrusted destinations and by tightening Chrome's Safe Browsing and site-isolation policies, though neither removes the underlying memory-safety bug and both impose friction on legitimate browsing; users can be steered away from unsolicited links as a low-cost stopgap. No public exploit code or confirmed active exploitation exists at time of analysis, so prioritise browser-fleet patch cadence over emergency containment, but track https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://issues.chromium.org/issues/551059870 for further detail. Remember that only the sandbox is breached by this bug alone, so endpoint detection should focus on post-exploitation behaviour and on chains that pair it with a separate sandbox-escape vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-416 use-after-free, a memory-safety class in which an object is freed while a stale pointer to it remains reachable; a subsequent dereference of that dangling reference lets an attacker reuse the freed allocation with attacker-controlled contents and redirect control flow. Here the dangling reference lives in Chrome's WebUI layer - the privileged chrome://-style surfaces built with WebUI bindings and Mojo IPC between renderer-side WebUI pages and browser-process handlers - which is why a crafted HTML page can drive the object lifetime into the freed state. Public reporting credits chrome-cve-admin@google.com and Chromium security severity is High; the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a low-complexity, network-delivered trigger that nevertheless demands the victim render attacker-controlled content. Because the corruption is reachable from renderer-side WebUI code, exploitation yields arbitrary code execution within the sandboxed process rather than at browser-process privilege, which is the standard Chrome threat model and the reason a sandbox escape would be needed for host-level impact. The scope (S:U) and the sandbox confinement should be read together: the impact is complete for confidentiality, integrity and availability of the sandboxed context only, not of the underlying operating system.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted HTML page over the network (AV:N/AC:L/PR:N) requires the user to visit it (UI:R); sandboxed code execution keeps S:U with high C/I/A within the process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 on desktop and ChromeOS create a high-severity endpoint risk: a crafted webpage can execute code inside the browser sandbox when a user opens it. The affected population is employees and shared-workstation users running unpatched Chrome, and while code execution is sandbox-confined and full host compromise would require a separate sandbox-escape flaw, no public exploit identified at time of analysis. Leadership should prioritize rapid patch compliance across the Chrome fleet because broad browser exposure can affect many users despite the user-interaction requirement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB