EUVD-2026-105495
GHSA-xpxj-7cvh-4vxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Extensions
-
ExecutionRead adjacent memory within sandbox
-
ImpactExfiltrate leaked data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Extensions component to process a crafted HTML page, meaning the victim must actively browse to attacker-controlled or compromised web content (UI:R) - there is no server-side or passive network trigger. Impact is LIMITED to a memory read that occurs inside the Chrome sandbox, so disclosure is bounded to data accessible within the sandboxed process and does not, by itself, achieve sandbox escape, code execution, or modification (I:N/A:N). Exploitation is further constrained to Chrome builds prior to 156.0.8078.47; patched/auto-updated clients are not affected. |
| Impact | This is a moderate-priority, not high-urgency, issue despite a medium CVSS of 6.5. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated bug that requires user interaction (visiting a crafted HTML page) and yields confidentiality impact only (memory disclosure), with no integrity or availability impact. Critically, the description qualifies the read as occurring 'inside the sandbox,' which bounds the real-world impact well below what C:H alone suggests - the CVSS C:H appears generous for a sandbox-constrained read and should be read in that context. All exploitation signals point low: EPSS is 0.22% (12th percentile), there is NO CISA KEV listing, and NO public exploit code is referenced. No SSVC decision data was provided in the input. Chromium itself rated this 'Medium.' The convergence of low EPSS, absence of KEV, and sandbox-bounded impact indicates this is a routine browser patch-cycle fix rather than an actively dangerous flaw; prioritize via normal Chrome auto-update cadence rather than emergency response. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing a crafted HTML payload that triggers the memory-corruption condition in Chrome's Extensions component; a victim who browses to the page may have adjacent process memory read from within the renderer/extension sandbox, potentially leaking sensitive in-memory data. No public proof-of-concept is referenced, and exploitation requires the user to visit attacker-controlled content, limiting opportunistic mass abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Extensions component in builds prior to 156.0.8078.47 allows an unauthenticated remote attacker to read memory inside the browser sandbox when a victim opens a crafted HTML page, with no integrity or availability impact - disclosure is bounded to data reachable by the sandboxed process. Google rates the issue Medium (Chromium severity) even though the CVSS 3.1 score reaches 6.5 on the strength of C:H; exploitation requires user interaction (UI:R) and does not by itself achieve sandbox escape or code execution. No public exploit code has been identified at time of analysis and EPSS is low at 0.22% (12th percentile), consistent with a moderate-priority rather than high-urgency issue; a vendor patch is available in 156.0.8078.47.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47 - upgrade to that build or later, either by allowing the standard auto-update mechanism and relaunching the browser (verify the running version via chrome://version) or by pushing the build through enterprise software deployment; the details are in the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium tracker at https://issues.chromium.org/issues/498733953. Fleet operators using Chrome Browser Cloud Management or equivalent policy tooling should force the version pin and enable relaunch notifications so long-lived browser sessions do not remain on the vulnerable build. No configuration switch removes the underlying memory-corruption condition, so where immediate updating is impossible the only realistic compensating controls are exposure reduction: restrict navigation to trusted, allow-listed web content (web content filtering or DNS/proxy policy), which shrinks the crafted-HTML attack surface at the cost of user flexibility, and disable or remove untrusted extensions so the Extensions component handles less attacker-influenced input - neither closes the flaw, and both carry functional and administrative trade-offs, so they are stopgaps while remediation is rolled out. There is no evidence of active exploitation, so emergency out-of-band action is not warranted, but the update should be scheduled in the normal patch cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-119, improper restriction of operations within the bounds of a memory buffer, expressed here as an out-of-bounds read in Chrome's Extensions component. Chrome's multi-process architecture places extension and renderer logic inside a restricted sandbox, so a successful out-of-bounds read yields only memory mapped into that sandboxed process - no write primitive, no control-flow hijack and no direct path to the browser process or OS. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N captures this precisely: network-delivered malicious HTML, no privileges required, but a user must navigate to the crafted page, and the consequence is confidentiality-only. Because the affected code sits in the Extensions surface rather than core navigation, trigger conditions depend on how the crafted page is processed by that component; the linked Chromium issue (issues.chromium.org/issues/498733953) is the authoritative technical record. Chrome's sandbox is the main mitigating layer - it converts a memory-safety defect into a bounded information leak rather than a full compromise, which is why Google assigned Medium severity rather than High.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page with no auth but required user interaction (UI:R); confidentiality-only impact from a sandbox-bounded memory read, no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB