EUVD-2026-105500
GHSA-9vwg-57ww-jp2w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage exercises vulnerable Extensions path
-
ExploitTrigger use-after-free (CWE-416)
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactControl renderer, stage further sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Google Chrome prior to 156.0.8078.47 to actively open attacker-controlled crafted HTML (UI:R); no authentication or special non-default configuration is needed since the affected component is the built-in Extensions subsystem present in default installs. The decisive LIMITING factor is that resulting code execution is confined to the renderer sandbox - meaningful host compromise requires chaining a separate sandbox-escape vulnerability - and the mandatory user navigation prevents fully passive, zero-click mass exploitation. |
| Impact | Signals are moderately strong but partially conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim open a page - a classic drive-by profile. However, Chromium's own security severity rating is only Medium, and the description explicitly scopes code execution to 'inside the sandbox,' meaning this UAF yields control of the renderer/extension process but NOT the host unless chained with a separate sandbox-escape bug - a material de-rating the 8.8 score does not capture (scope is correctly S:U). No EPSS score was provided, so exploitation probability cannot be quantified. KEV status is not present in the input, so under the precision rules this is 'no public exploit identified at time of analysis'; there is no POC signal either. Net: this is a legitimately patchable high-CVSS browser memory-corruption bug worth prompt patching given Chrome's ubiquity, but absent KEV/EPSS/POC evidence and given the sandbox-confined impact and Medium vendor rating, it is not a drop-everything emergency relative to a full sandbox-escaping RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that exercises the vulnerable extensions code path; when a victim using an unpatched Chrome (prior to 156.0.8078.47) visits it, the use-after-free is triggered and the attacker gains arbitrary code execution within the renderer sandbox. No authentication is required, but the victim must actively navigate to the page (UI:R), and full host compromise would require chaining an additional sandbox escape. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Extensions subsystem before 156.0.8078.47 lets unauthenticated remote attackers execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page, with high confidentiality and integrity impact under CVSS 8.8. No public exploit identified at time of analysis, and exploitation is constrained by the required user navigation and by the renderer sandbox, so host compromise would require chaining a separate sandbox escape. Google has released a vendor patch in Chrome 156.0.8078.47.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later and restart the browser; Google reports that a vendor patch is available, and the stable-channel advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Administrators should enforce the update through enterprise software management and verify the browser version after deployment. If immediate patching is not possible, reduce exposure by preventing users from opening untrusted HTML in Chrome, such as routing untrusted content through a hardened alternative browser or isolated environment, and consider restricting extension installation or activation via enterprise policy; these are compensating controls only, carry usability and compatibility trade-offs, and do not replace the vendor fix because the vulnerable Extensions subsystem is present in default installs. No public exploit was identified at time of analysis, but the UI:R condition means blocking suspicious HTML attachments and pages at email and web gateways can reduce trigger opportunities.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 use-after-free in Chrome's Extensions subsystem, which handles extension APIs, bindings, and content-script interactions in the renderer. A dangling pointer reachable through attacker-controlled HTML can cause memory corruption that may be shaped into arbitrary code execution inside the sandbox. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a remote, low-complexity, unauthenticated attack that requires victim interaction and has scope unchanged; the sandbox boundary is not crossed by this CVE alone. No CPE strings were supplied, but EUVD identifies affected Chrome versions below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page, no auth (PR:N) but victim navigation required (UI:R); code exec yields high C/I/A within the unchanged renderer scope (S:U), consistent with the vendor vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome deployments older than 156.0.8078.47 carry a high-severity memory corruption weakness in the Extensions component that could allow a crafted webpage to run code inside the browser's renderer sandbox and put user data confidentiality and integrity at risk. The flaw requires user navigation and, for full host compromise, a separate sandbox escape, and no public exploit has been identified at the time of analysis, so the near-term organizational exposure is serious but bounded. Leadership should prioritize rapid browser update enforcement because Chrome is widely deployed and unpatched endpoints remain exposed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB