EUVD-2026-105464
GHSA-p962-5p42-4jcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious script drives WebRTC
-
ExploitTrigger use-after-free in freed object
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactAttempt sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Chrome (UI:R - a page visit, no click beyond navigation), and the WebRTC code path must be reachable, which it is by default in standard Chrome builds since WebRTC is enabled out of the box. The key LIMITING factor is that successful code execution is confined to the renderer sandbox per the vendor statement, so a separate sandbox-escape vulnerability is needed for full host compromise; additionally only Chrome versions prior to 156.0.8078.47 are affected, so patched or auto-updated installations are not exploitable. No authentication is required (PR:N). |
| Impact | This is a genuine high-priority patching target. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes remote, low-complexity, unauthenticated exploitation requiring only that a victim visit a crafted HTML page - the classic drive-by profile for a browser flaw. The CWE-416 use-after-free with High Chromium severity and C:H/I:H/A:H impact is consistent with memory-corruption-to-code-execution. One important qualifier the vendor states explicitly: code execution occurs INSIDE the renderer sandbox, so by itself this does not yield host compromise without a separate sandbox-escape chain - the CVSS base score does not model that mitigating boundary. No EPSS score was provided in the input, and there is no CISA KEV listing and no public POC referenced, so there is no evidence of active exploitation or weaponization at this time; the priority here derives from the ubiquity of Chrome and the ease of the attack vector rather than from any confirmed exploitation signal. No signals conflict, but note that absent EPSS/KEV data the real-world exploitation likelihood cannot be quantified from the provided intelligence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript/HTML that drives WebRTC into a use-after-free condition; a victim who simply browses to the page triggers the flaw, letting the attacker execute arbitrary code within the Chrome renderer sandbox. No public exploit code was identified in the provided data, and full system compromise would additionally require chaining a sandbox escape. The low attack complexity (AC:L) and need only for a page visit (UI:R) make this practical at scale via malvertising or watering-hole pages. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote code execution inside the Chrome renderer sandbox is achievable via a use-after-free condition in the WebRTC implementation of Google Chrome builds prior to 156.0.8078.47. A victim only needs to load a crafted HTML page (UI:R, PR:N per the CVSS vector), and because WebRTC is enabled by default in standard Chrome builds the vulnerable code path is reachable without special configuration. The vendor rates Chromium security severity High, and while code execution is confined to the sandbox - meaning a separate sandbox escape is required for full host compromise - the CVSS 8.8 and confirmed availability of a vendor patch make this a genuine high-priority patching target; no public exploit code has been identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - the vendor-released patch for this issue - via the stable-channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, and apply the corresponding ChromeOS stable-channel update from http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html on ChromeOS devices. Because the attack only requires the victim to load a crafted page, the practical priority is closing the exposure window rather than user behavior: verify auto-update is functioning on managed fleets, force a relaunch so the new build is actually running (Chrome only swaps binaries on restart), and confirm the reported version is 156.0.8078.47+ from the browser's about page or your management console. If immediate fleet-wide upgrade is not possible, reduce the attack surface by disabling WebRTC via the WebRtcAllowLegacyTLSProtocols/WebRTC-related enterprise policies or the WebRTC disable flag where your policy set supports it - the trade-off is that this breaks video conferencing, screen sharing, and any peer-to-peer data features in browser apps, so scope it to high-risk or unmanaged-exposed user groups and revert once patched. Blocking arbitrary untrusted web content is not a viable control here, and since the impact is sandbox-confined, ensuring sandbox protections remain enabled (no --no-sandbox flags in managed shortcuts) preserves the containment that limits this bug to renderer-level code execution. No public exploit code has been identified at time of analysis, so patching is preventive rather than incident-driven, but the high CVSS 8.8 and default-on reachability of WebRTC justify treating this at the top of the next patch cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in WebRTC, the real-time audio/video and peer-to-peer data transport stack shipped and enabled by default in Chromium and Google Chrome. A use-after-free occurs when memory backing a WebRTC object is released while a reference to it remains; the attacker then influences reallocation of that memory so that the dangling pointer is dereferenced against attacker-influenced contents, which in Chromium's renderer typically yields control-flow hijack. The attacker's vector is a crafted HTML page that drives the WebRTC API (peer connections, data channels, media handling) into the faulty lifecycle transition, so the corruption is reachable from ordinary web content rather than requiring the user to install anything. Per the vendor statement the resulting arbitrary code execution occurs inside the renderer sandbox, so the primitive is sandbox-confined and chaining with a separate sandbox-escape bug is needed for host-level compromise. Affected builds are those earlier than 156.0.8078.47; the issue was reported through chrome-cve-admin@google.com and tracked as Chromium issue 568945639.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N) exploitable with only a visit (UI:R) and no auth (PR:N); UAF yields in-sandbox code execution (C:H/I:H/A:H) with scope unchanged as no cross-boundary escape is claimed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity WebRTC use-after-free flaw that allows remote code execution inside the browser's renderer sandbox when a user loads a crafted HTML page. Because WebRTC is enabled by default and exploitation requires only routine web browsing, the vulnerability affects the organization's broad Chrome user base, though full host compromise would require an additional sandbox escape. Leadership should prioritize patching to 156.0.8078.47 or later given the high CVSS score and the availability of a vendor fix.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB