EUVD-2026-105440
GHSA-ppvh-jwmf-v239
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Privacy component
-
ExecutionReclaim freed object with attacker data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user interaction (UI:R): the victim must load an attacker-controlled or compromised HTML page in Chrome versions prior to 156.0.8078.47 - no authentication or prior privilege is needed (PR:N). The significant limiting factor is that arbitrary code execution is confined to the renderer sandbox (scope unchanged), so escaping to the host OS requires chaining an additional sandbox-escape vulnerability. Exploitation is further limited by Chrome's automatic update mechanism, which rapidly reduces the vulnerable population once the stable-channel fix is distributed. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - the standard drive-by profile for browser bugs, and Chromium rates the severity High. CWE-416 use-after-free in a memory-unsafe renderer is a reliably exploitable class and the 'RCE'/'Memory Corruption' tags align with the use-after-free root cause. However, a key limiter is explicit in the description: code execution occurs INSIDE the Chrome sandbox (S:U, scope unchanged), so full host compromise additionally requires a separate sandbox-escape bug - the scope-unchanged metric is consistent with this. No EPSS score was provided, so statistical exploitation probability cannot be stated. This CVE is NOT on CISA KEV and no public POC was provided, so exploitation status is: no public exploit identified at time of analysis. Net: real and patch-worthy given Chrome's reach and the UAF class, but not confirmed as actively exploited, and sandboxed impact tempers the raw 8.8 somewhat. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects a malicious ad/iframe into a trusted site) that triggers the use-after-free in Chrome's Privacy component when the victim's browser renders it. Successful exploitation yields arbitrary code execution within the renderer sandbox; a chained sandbox-escape would be required to reach the underlying OS. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Privacy component lets a remote attacker execute arbitrary code inside the renderer sandbox on any build prior to 156.0.8078.47, triggered simply by getting the victim to load a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R, scope unchanged). The flaw is a heap memory-lifetime corruption issue (CWE-416) whose realistic outcomes are renderer-level code execution or a browser crash/denial of service; escaping to the host operating system would require chaining a separate sandbox-escape bug, and Chrome's automatic updater rapidly shrinks the exposed population once the stable fix lands. Google shipped 156.0.8078.47 as the patched stable release, tracked as Chromium issue 558464760 and rated High by the Chromium security team; no public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47 (stable channel). Upgrade immediately - end users can force the update from chrome://settings/help and must fully restart the browser (all windows) for the new binary to take effect; enterprises should push 156.0.8078.47 or later through Chrome Enterprise policies (e.g. relaunch-notification and version-pinning policies via Google Update / managed preferences) and verify fleet compliance against the fixed build, since lingering pre-156.0.8078.47 installs, sideloaded binaries and frozen update channels are the main residual exposure. No vendor-documented configuration workaround exists for this defect, so mitigation is patch-first. Because exploitation is reachable only through the renderer sandbox, do not weaken isolation: never launch Chrome with --no-sandbox or --disable-web-security (side effect: removes the primary containment boundary that keeps this bug from becoming host compromise), and keep Site Isolation enabled and current, as it forces cross-site content into separate renderer processes and reduces the value of a single corrupted renderer. Organizations that cannot patch a subset of endpoints within the update window should route untrusted web browsing through remote browser isolation or a disposable VM/snapshot profile (trade-off: added latency and broken rich-web workflows), and can temporarily narrow exposure by blocking untrusted or newly registered domains at the proxy (trade-off: high false-positive rate and no protection against compromised legitimate sites). Reference advisories: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://nvd.nist.gov/vuln/detail/CVE-2026-113305.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (use after free) in the code paths that implement Chrome's Privacy features. Chrome is a multi-process browser: web content is parsed and rendered in a sandboxed renderer process, and a UAF means the Privacy component frees an object (typically a heap-allocated DOM/service-side structure) but continues to hold and later dereference a stale pointer. An attacker who controls the order and timing of object teardown from a crafted page can reallocate the freed slot with attacker-influenced data (heap grooming/spraying) and hijack a virtual dispatch or write through the dangling reference - the classic path from memory corruption to controlled instruction flow. Modern Chrome mitigations (ASLR, CFI, PartitionAlloc hardening, MiraclePtr/BRP-style dangling-pointer protections where applied) raise the bar but do not eliminate the class. Critically, the corruption is confined to the renderer's own address space and its sandbox token, so the CVSS scope is unchanged (S:U) and the impact is arbitrary code execution as the sandboxed renderer, plus crash/denial of service if the corruption is not shaped deliberately. The Privacy area is reachable from ordinary web content, which is why user interaction (UI:R, loading a page) is the only prerequisite and no authentication or prior privilege (PR:N) is needed. Affected artifacts are the Chrome desktop builds below 156.0.8078.47; the Chromium bug 558464760 remains the authoritative technical record and is access-restricted, so no further exploit-specific detail is publicly available.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but requires the victim to open it (UI:R); sandboxed code execution keeps scope unchanged (S:U) with high C/I/A in the renderer.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome releases prior to 156.0.8078.47 contain a high-severity memory corruption flaw in the browser's Privacy component that allows a remote attacker to run code inside the renderer sandbox whenever a user simply loads a malicious web page. Because Chrome is deployed across virtually every workstation and remote-work endpoint in the organization, leadership should treat this as a fleet-wide exposure with a short, well-defined remediation path rather than an isolated application issue. Google has already published a fixed stable build, and enabling standard auto-update behavior will close the exposure for the large majority of users within days.
Apply vendor patch (Google Chrome 156.0.8078.47). Until the fixed build is deployed, keep Chrome's automatic updater enabled and force relaunches so the update is applied, prioritize updating users whose browsing carries the greatest exposure to untrusted web content, and rely on the renderer sandbox - which limits this flaw to browser-process impact unless chained with a separate sandbox escape - as a partial containment measure while remediation completes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB