EUVD-2026-105431
GHSA-64v3-68x6-xxp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger Canvas use-after-free in renderer
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in Chrome - consistent with UI:R, the user must navigate to or render a crafted HTML page (e.g., via a malicious link, a compromised site, or a malicious ad/iframe). No authentication is required (PR:N) and the affected Canvas rendering path is reachable in default configurations, so no special feature toggle is needed. The key LIMITING factor is that successful code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'); achieving code execution on the underlying host requires an additional sandbox-escape vulnerability. Only builds prior to 156.0.8078.47 on affected desktop and ChromeOS channels are vulnerable. |
| Impact | This is a genuine high-priority patch item for any environment running Chrome. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page - a trivial bar for a web browser. CWE-416 use-after-free in the Canvas component is a classic, highly weaponizable memory-corruption class that Chromium UAF bugs are repeatedly turned into working exploits. Important nuance: the description explicitly states code execution is 'inside the sandbox,' and the CVSS scope is Unchanged (S:U), so by itself this bug yields attacker code only within the renderer sandbox and would need to be chained with a separate sandbox-escape to achieve full host compromise - this tempers the real-world severity relative to the raw 8.8. No EPSS score was provided in the input, and there is no CISA KEV listing or POC indicator, so exploitation status is: no public exploit identified at time of analysis. Google's release-note disclosure practice typically withholds bug details until the majority of the installed base is patched, meaning absence of a POC now does not imply low future exploitability. Net assessment: patch promptly, but note the single-signal gap (no EPSS/KEV/POC data) and the sandbox-containment caveat that distinguishes this from a full unauthenticated RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that manipulates Canvas objects to trigger the use-after-free. A user running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the freed Canvas object is reused, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code is identified at this time; realistic full compromise would require chaining this with a separate sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free memory corruption in Google Chrome's Canvas implementation allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47 across desktop and ChromeOS channels. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the target must navigate to or render attacker-controlled content such as a malicious link, compromised site, or injected ad/iframe, and the Canvas path is reachable in default configurations with no special toggle. Impact is bounded by the sandbox - code execution stays within the renderer (S:U) and host-level compromise would require a separate sandbox-escape - and at time of analysis no public exploit code has been identified; enterprise patch cadence, not emergency response, is the driver, and Google rates the flaw Chromium security severity High (CVSS 8.8).
RemediationAI
Upgrade to Google Chrome 156.0.8078.47 or later - the vendor-released patch - on all desktop platforms and on ChromeOS, and verify the version in chrome://version after deployment; the fixed builds and channel-specific version numbers are listed at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html, with technical detail in the Chromium issue 553117109 (https://issues.chromium.org/issues/553117109). Because the Canvas path cannot be disabled selectively, there is no clean configuration workaround: disabling JavaScript or WebGL via enterprise policy blocks the exploit primitive but breaks most line-of-business web applications, and forcing sites into a strict content-security regime reduces exposure to injected ads and iframes only marginally. Where patching must be staged, prioritize browsers used for privileged SaaS administration and external browsing, front untrusted content with remote browser isolation or virtualized browsing so crafted pages render outside the trusted endpoint, and treat the renderer sandbox as the compensating control that limits - but does not eliminate - the blast radius until the update lands.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Canvas rendering path, the Blink/Chromium subsystem that backs the HTML <canvas> element and its 2D and WebGL drawing contexts, including GPU-accelerated rasterization and the associated graphics resource lifetimes. A use-after-free means an object backing canvas drawing state or its underlying buffer was freed while a reference remained reachable; a crafted HTML page can then force reallocation of the freed memory with attacker-influenced contents and redirect a virtual call or write through the stale pointer, which is why the issue is classified as memory corruption with remote code execution potential rather than a simple crash. Because the vulnerable surface is script-reachable in every default desktop and ChromeOS configuration, the only real precondition is that the user renders the page. The published CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector confirms network delivery, no privileges required, mandatory user interaction, and unchanged scope - the last point matters: the compromise is contained to the Chrome renderer sandbox, so exfiltration of session data, credentials, or same-origin content is realistic while full host takeover still requires chaining an independent sandbox-escape bug.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted web page is network-delivered (AV:N) and reliably triggered (AC:L) with no auth (PR:N) but requires the victim to load it (UI:R); sandbox-contained code execution keeps scope Unchanged (S:U) with full C/I/A impact in-renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome is exposed to a high-severity memory-corruption flaw that could allow a crafted webpage to execute code inside the browser’s renderer sandbox on unpatched desktop and ChromeOS systems. Exploitation requires a user to open or render attacker-controlled content; no public exploit identified at time of analysis means immediate risk is driven by patch coverage rather than active incident response. Leadership should prioritize fleet-wide Chrome updates to 156.0.8078.47 or later because the browser is widely used to access untrusted web content.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB