EUVD-2026-105453
GHSA-3mhf-rq34-2rxj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalicious content abuses ServiceWorker code path
-
ExecutionTrigger memory corruption (buffer overflow)
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to visit a crafted HTML page under attacker control (UI:R / UI:P), so it is not fully drive-by-silent - some user navigation or interaction is needed, though no authentication (PR:N) and no special Chrome configuration are required against default installs of Chrome prior to 156.0.8078.47. The key LIMITING factor is that arbitrary code execution is confined to the renderer sandbox (Scope Unchanged); converting this into host compromise requires a separate, unrelated sandbox-escape vulnerability. Affected desktop and ChromeOS builds below the fixed version are the scope. |
| Impact | This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the classic browser drive-by profile. However, the description explicitly scopes code execution to 'inside the sandbox' and the vector keeps Scope Unchanged (S:U), meaning a successful exploit compromises the renderer sandbox but does NOT by itself yield full host takeover; a separate sandbox-escape chain would be required for that. Chromium rates the severity 'High' (not Critical). No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active exploitation or weaponization. The main signals are therefore consistent (network vector + user interaction + memory corruption in a widely-exploited component), but the absence of KEV/EPSS/POC and the sandbox-bounded impact argue for prompt patching rather than crisis response. Missing data: EPSS probability and POC status are unknown and should be monitored, as browser memory-corruption bugs are frequently exploited post-disclosure. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious content that registers or abuses a ServiceWorker, then lures a victim to visit it. When the victim's Chrome (prior to 156.0.8078.47) processes the crafted page, the ServiceWorker code path triggers memory corruption and the attacker achieves arbitrary code execution within the browser's renderer sandbox. No public exploit code is identified in the provided data, and full host compromise would require chaining an additional sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote code execution inside the renderer sandbox affects Google Chrome prior to 156.0.8078.47 through memory corruption in the ServiceWorker component when a user visits a crafted HTML page. The issue requires user interaction but no authentication, and successful exploitation yields arbitrary code execution within Chrome's sandbox rather than direct host compromise; escaping the sandbox would require a separate vulnerability. No public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released a fixed Chrome build.
RemediationAI
Vendor-released patch: update Google Chrome to 156.0.8078.47 or later, and apply the corresponding ChromeOS stable-channel update referenced in the ChromeOS advisory. Restart the browser after updating and verify the version through chrome://version; enterprise administrators should push the fixed build through their normal Chrome management channels and track Chromium issue 566136673 at https://issues.chromium.org/issues/566136673. If immediate upgrade is not possible, reduce exposure by restricting users to trusted sites through policy-managed URL allowlists/blocklists and, where operationally acceptable, limiting ServiceWorker-dependent functionality or extensions that require broad web access; these compensating controls can break legitimate web applications and do not eliminate the underlying memory corruption. Do not rely on the renderer sandbox as a fix, because it only constrains the impact unless a separate sandbox-escape flaw is chained.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ServiceWorker is a web platform API that lets sites run background scripts for caching, offline behavior, and network interception; it processes attacker-influenced web content inside Chrome's renderer process. CVE-2026-113318 is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), meaning malformed input can cause out-of-bounds memory access that may be steered into arbitrary code execution in the renderer sandbox. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a remotely reachable, low-complexity flaw requiring a user to open a crafted page, with high confidentiality, integrity, and availability impact but Scope Unchanged; the sandbox is the key limiting control. Affected builds are Chrome desktop and ChromeOS releases below 156.0.8078.47, as reflected in the Chrome stable-channel advisories and the EUVD entry. No CPE strings were supplied, so the affected platform matrix cannot be independently enumerated from CPE data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page, no privileges (PR:N) but user must load the page (UI:R); impact stays in-sandbox so Scope Unchanged with high C/I/A to the renderer process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity memory corruption flaw in the ServiceWorker component that can allow remote code execution within the browser sandbox when a user visits a crafted webpage. The attack requires user interaction and is contained by Chrome's sandbox, so widespread host-level compromise is unlikely without a separate sandbox escape; however, users on unpatched browsers remain exposed to browser-level compromise and follow-on data risk. Leadership should prioritize updating Chrome across the workforce because the vendor fix is available and no public exploit has been identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB