EUVD-2026-105509
GHSA-hhxw-rfgx-v568
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Extensions
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to actively load attacker-controlled web content in Chrome (UI:R) on a version prior to 156.0.8078.47; no authentication or pre-existing privileges are needed (PR:N). The trigger lies in the Extensions component, and the resulting code execution is explicitly CONFINED TO THE SANDBOX - reaching the underlying OS or other processes would require an additional, separate sandbox-escape vulnerability not covered by this CVE. The practical limiting factors are therefore: mandatory user interaction (visiting/rendering a malicious page) and the sandbox boundary, which together reduce real-world impact below what the 8.8 score alone implies. |
| Impact | Multiple signals converge on this being a genuine but not emergency-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page, which maps to a realistic drive-by/watering-hole threat model and yields the 8.8 High base score. The single most important mitigating detail - stated explicitly in the description - is that code execution occurs 'inside the sandbox' (renderer process), so this is NOT by itself a full host compromise; a separate sandbox-escape would be required to reach the OS, which the NVD vector reflects with S:U (no scope change). Note the tension: Google rates the Chromium security severity only 'Medium' while the derived CVSS is 'High' (8.8) - this is the normal Chrome discrepancy where renderer-only RCE is scored severe on impact but tempered by Google because it is sandbox-confined. No EPSS score was provided, so exploitation probability cannot be quantified. This CVE is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis; treat it as patch-on-normal-browser-update cadence rather than drop-everything, while recognizing Chrome UAF renderer bugs are historically a common component of exploit chains. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's Extensions code when a victim browses to it (UI:R user interaction). Successful exploitation yields arbitrary code execution within the renderer sandbox; absent a chained sandbox escape, impact is confined to the sandboxed process. No public exploit or POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free memory corruption in Google Chrome's Extensions component (all versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to load a crafted HTML page run arbitrary code inside the browser sandbox; no authentication or prior privileges are required, but the victim must actively render attacker-controlled content (UI:R), and the resulting execution is confined to the sandbox. Rated 8.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H, CWE-416) with Chromium severity Medium - the gap reflects the sandbox boundary, which an attacker would need a separate escape to cross. No public exploit code and no CISA KEV listing were identified at time of analysis; a vendor patch is available.
RemediationAI
Upgrade to Google Chrome 156.0.8078.47 or later - the vendor-released patch documented in the stable-channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) - and verify the installed build under chrome://version; enterprise fleets should push the version through their update mechanism (Chrome Enterprise policies such as auto-update or a managed Chrome Browser Cloud Management rollout) and confirm compliance before closing the ticket, remembering that Chromium derivatives need their own patched builds. Where immediate upgrade is impossible, the highest-value compensating control is reducing exposure to attacker-supplied HTML: enforce strict URL allowlisting or a restrictive proxy for managed users, and disable or tightly scope extensions via ExtensionInstallAllowlist/ExtensionInstallBlocklist policies - trading user flexibility and some line-of-business tooling for a smaller attack surface. Site isolation (strict) and the renderer sandbox should remain enabled and should not be weakened as a workaround, since they are what confines this bug's code execution; likewise, do not enable unsupported flags that relax site isolation on the assumption the fix is already deployed. Because exploitation requires the victim to render a crafted page, phishing-resistant browsing controls, disabling of untrusted third-party content embedding, and user awareness of suspicious links provide marginal but real reduction of trigger likelihood; none of these substitute for patching, and no public exploit code has been identified to drive emergency out-of-band measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (use-after-free) is a memory-safety defect in which an object is freed while a dangling reference to it remains, so later use of that reference reads or writes attacker-influenced memory. In Chrome's Extensions subsystem - the component handling extension loading, bindings, and renderer-side extension APIs - an attacker able to shape heap state via a crafted HTML page can attempt to reclaim the freed allocation with controlled data and hijack a virtual call or pointer, yielding code execution in the renderer process. Because Chromium's site isolation and renderer sandbox place the compromised process in a restricted OS-level jail, the primitive delivered here is sandboxed code execution (Chromium severity Medium) rather than full system compromise; escaping to the host would require chaining a distinct sandbox vulnerability outside this CVE's scope. Affected CPE coverage maps to Google Chrome builds below 156.0.8078.47 across desktop platforms, per EUVD's affected-version data and the Chrome stable-channel advisory. Exploitation also requires winning a heap-layout race against allocator mitigations (e.g., PartitionAlloc hardening), which raises reliability demands on any exploit.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to open it (UI:R); sandbox-confined so S:U, with high renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity use-after-free flaw in the Extensions component that can let attacker-controlled web content execute code inside the browser sandbox. Because Chrome is broadly deployed across the workforce, unpatched endpoints create a wide potential attack surface, although exploitation requires a user to load a crafted page and the sandbox boundary limits direct impact. Leadership should prioritize rapid browser patching given the low attack complexity and the possibility that a separate sandbox escape could elevate the risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB