EUVD-2026-105481
GHSA-3v9f-cf5h-qhx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in SiteIsolation
-
ExecutionReuse freed object to corrupt memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load a crafted HTML page in a vulnerable Chrome build (any version prior to 156.0.8078.47), triggering the use-after-free in the SiteIsolation component - this user-interaction requirement (UI:R) is the primary limiting factor, as the attack cannot fire without a user visiting attacker-influenced content. No authentication or special privileges are needed (PR:N). A critical scope limit: code execution is confined to the renderer sandbox (S:U), so achieving host-level compromise additionally requires chaining a separate sandbox-escape vulnerability; absent that, impact is bounded to the renderer process. |
| Impact | Strong signals point to real but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H → 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring user interaction (visiting a crafted HTML page). However, the Chromium team self-rated this 'Medium', and the description explicitly scopes code execution to 'inside the sandbox' - meaning a successful exploit yields control of the renderer process, not the host, unless chained with a separate sandbox-escape bug. This gap between the 8.8 NVD-style score and the vendor's Medium rating is the key tension: the 8.8 treats renderer-process compromise as full C/I/A impact (consistent with S:U), but the practical blast radius is contained by Chrome's multi-process sandbox. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - this is not a drop-everything emergency. That said, Chrome's near-ubiquitous footprint and the vendor-confirmed patch make timely browser updating the correct priority. Treat as 'patch promptly in normal cycle' rather than 'emergency out-of-band', barring new exploitation intelligence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's SiteIsolation component. When a victim is lured into visiting the page, the freed object is reused to corrupt memory and potentially execute attacker-controlled code within the renderer sandbox. No public exploit code was identified at time of analysis, and full host compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Chrome's SiteIsolation component allows a remote attacker who convinces a victim to load a crafted HTML page to corrupt renderer memory and potentially execute arbitrary code at the privilege of the renderer process in any Chrome build prior to 156.0.8078.47. Unauthenticated attackers need only user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but the impact is scope-limited: because the flaw lives in sandboxed renderer code, host-level compromise requires chaining a separate sandbox-escape bug, which is why Google rates the issue only Chromium severity Medium despite the high base score. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis and the bug is not in CISA KEV, so risk is real but conditional on user browsing behavior rather than opportunistic scanning.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later immediately - use chrome://settings/help to force the update and relaunch, or push the fixed build through your normal package-management or enterprise-update channel (Chrome for Enterprise, MSI/PKG, or distro repository), and verify the reported version after restart because Chrome only applies the update on relaunch; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the engineering record is https://issues.chromium.org/issues/40055319. Organizations running Chromium-embedded browsers must wait for or track the equivalent release from that vendor, since installing Chrome does not update them. There is no configuration toggle that removes this exposure: Site Isolation and the renderer sandbox are exactly the components that bound the damage, so do not attempt to "harden" by disabling Site Isolation, and never launch Chrome with --no-sandbox or --disable-site-isolation-trials, as doing so removes the sandbox-escape chaining requirement and converts a renderer-scoped bug into full host compromise - the trade-off is a meaningful increase in exploitability for this and any future renderer bug. Until the patched build is universally deployed, the only practical compensating controls are reducing the attack surface for crafted HTML: enforce update compliance via browser management policy, restrict high-value users to allow-listed sites or a managed proxy that blocks uncategorized destinations, and run Chrome in a hardened VM or remote-browsing isolation tier for users who must browse untrusted content - each of these carries an operational or usability cost and none prevents exploitation once a malicious page is actually rendered, so patching remains the only real fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiteIsolation is the Chromium subsystem that implements Site Isolation: renderer processes are bound to SiteInstances and BrowsingInstances so that documents from different sites never share an address space, and cross-site navigations, out-of-process iframes, and process swaps are brokered by the browser process. A CWE-416 use-after-free in this lifecycle logic means a SiteInstance, BrowsingInstance, or associated navigation/frame object can be freed while a reference to it survives, letting attacker-controlled HTML drive a dangling-pointer dereference inside the renderer. Chrome's memory allocator (PartitionAlloc) and the V8/Blink object graph make such dangling references reliably convertible into controlled reads and writes, which is why arbitrary code execution inside the sandbox is plausible rather than merely a crash; the tag list also flags denial of service as a lower-bound outcome. The critical architectural constraint is the sandbox boundary (scope unchanged, S:U): the primitive yields code execution as the renderer's restricted token, and turning that into OS-level code execution requires a second, independent sandbox-escape vulnerability. Google's Medium severity rating reflects that chaining requirement plus the mandatory UI:R interaction, whereas the 8.8 base score reflects high confidentiality and integrity impact if a chain is available.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires visiting the page (UI:R); S:U and high C/I/A reflect full renderer-process compromise contained within the sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity memory corruption flaw in the SiteIsolation component that can crash or corrupt the browser renderer when a user simply visits a crafted web page. No public exploit or active exploitation has been observed, and the built-in browser sandbox limits damage to the renderer process, so organization-wide compromise is unlikely without a secondary attack. Leadership should care because the exposure window is defined entirely by endpoint patch latency, and the impacted population is every employee who browses the web - practically the entire workforce.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB