EUVD-2026-105472
GHSA-rxjg-5v9r-qqr4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers Paint memory corruption
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Chrome prior to 156.0.8078.47 to load attacker-controlled HTML (UI:R - the user must visit or be redirected to a crafted page), making this a user-interaction-gated drive-by rather than a zero-click flaw. No authentication or special privileges are needed (PR:N), and default configurations are affected since the Paint rendering component is always active. The principal limiting factor is that resulting code execution is confined to the renderer sandbox (S:U); meaningful host compromise additionally requires a separate sandbox-escape vulnerability, so the realistic standalone impact is lower than the 8.8 score implies. |
| Impact | This is a credible but qualified priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity flaw needing no privileges, consistent with a browser rendering bug triggered by a crafted HTML page - a realistic drive-by vector for a ubiquitous product, which justifies the 8.8 score. However, the description explicitly states code execution occurs 'inside the sandbox' and the vector reports S:U (scope unchanged), meaning this alone does not yield host compromise without a separate sandbox-escape chain; raw CVSS does not capture that mitigating boundary. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no public exploitation signal - this is NOT confirmed actively exploited. Google-reported Chrome High-severity Paint bugs are historically attractive to exploit developers, so patching urgency remains elevated despite the absence of exploitation data, but the practical impact is bounded by the UI:R requirement and the sandbox confinement. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious markup that triggers the memory-corruption flaw in Chrome's Paint component when a victim browses to it. Successful exploitation corrupts renderer memory to execute attacker-controlled code within the browser sandbox; full host compromise would require chaining an additional sandbox escape. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Paint rendering component can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in a version prior to 156.0.8078.47. Exploitation is user-interaction-gated because the victim must visit or be redirected to attacker-controlled content, and the resulting code execution is confined to the renderer sandbox unless combined with a separate sandbox-escape flaw. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.
RemediationAI
Vendor-released patch: Chrome 156.0.8078.47. Upgrade Google Chrome to version 156.0.8078.47 or later using the desktop stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; organizations should enforce this version through their browser update management tooling and verify the deployed build. ChromeOS administrators should apply the corresponding stable-channel update described at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html and confirm the fixed ChromeOS release in that advisory, since the provided data does not specify the exact ChromeOS version. No supported feature toggle is documented for disabling the Paint component, so if immediate patching is not possible, constrain browsing to trusted sites and consider remote browser isolation or virtualized browsing for high-risk use; these controls reduce exposure but add latency, infrastructure cost, and usability restrictions, and they do not replace upgrading to 156.0.8078.47. Retain Chrome's renderer sandbox as a defense-in-depth layer, recognizing that the assessed impact is contained to the sandbox unless a separate sandbox-escape vulnerability is also present.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified under CWE-119, improper restriction of operations within the bounds of a memory buffer, which in this case manifests as memory corruption in Chrome's Paint rendering path. Crafted HTML content can trigger the bounds-handling failure when Chrome renders a page, corrupting renderer memory in a way that may permit arbitrary code execution inside the sandbox. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms remote reachability, no required privileges, required user interaction, and unchanged scope, meaning the immediate impact is contained to the renderer process. Default Chrome configurations are exposed because the Paint component is always active during normal browsing, but meaningful host compromise would require an additional sandbox-escape vulnerability. The supplied data does not include CPE identifiers; EUVD lists Chrome versions below 156.0.8078.47 as affected.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but victim must visit it (UI:R); code runs in-sandbox so scope is unchanged (S:U) with high renderer-level C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 carry a high-severity memory corruption flaw in the Paint rendering component that can allow a remote attacker to execute code within the browser sandbox when a user visits crafted web content. Because Chrome is widely deployed across the workforce, unpatched endpoints could expose users to compromise during routine browsing, although the renderer sandbox limits standalone impact and no public exploit was identified at time of analysis. Leadership should prioritize rapid validation and deployment of the vendor fix to reduce exposure across the user base.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB