EUVD-2026-105523
GHSA-8mf8-fq2v-cgj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in PerformanceAPIs
-
ExecutionReclaim freed object to corrupt memory
-
ImpactExecute arbitrary code, potentially escaping sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to load an attacker-controlled crafted HTML page that exercises the PerformanceAPIs (Performance/PerformanceObserver/performance timing interfaces); this user interaction (UI:R - navigating to or being redirected to the malicious page) is the primary limiting factor. No authentication, special privileges, or non-default configuration is needed (PR:N) and affected default installations are exploitable, but Chrome's automatic update mechanism and the requirement for the user to visit the page constrain real-world exploitability. The claimed escape 'outside the sandbox' is described as potential, not confirmed, so full host compromise is not guaranteed. |
| Impact | Signals conflict and must be reconciled carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a network-reachable, unauthenticated, low-complexity memory-corruption flaw with a scope change (S:C) consistent with the description's claim of code execution 'outside the sandbox' - a browser sandbox escape, which is among the most serious Chrome outcomes. However, Google's own Chromium severity rating is only 'Medium', which materially contradicts the 9.6 Critical CVSS and the 'outside the sandbox' phrasing; most PerformanceAPIs renderer UAFs are in-sandbox and rated Medium, so either the CVSS scope change is over-stated or the sandbox-escape claim is aspirational ('potentially execute') rather than demonstrated - verify the actual impact with Google before treating this as a confirmed full-chain RCE. No EPSS score was provided, and there is no CISA KEV listing or POC indication in the input, so exploitation status is 'no public exploit identified at time of analysis'. Net assessment: a vendor-patched Chrome memory-corruption bug worth routine-to-prompt patching given Chrome's ubiquity and auto-update cadence, but the Critical CVSS likely overstates real-world risk relative to Google's Medium rating, and exploitation requires user interaction (visiting a page) with no evidence of active or public exploitation. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML/JavaScript that abuses the PerformanceAPIs to trigger a use-after-free; when a victim running an unpatched Chrome (< 156.0.8078.47) visits the page, the freed object is reclaimed and manipulated to corrupt memory and potentially achieve code execution. No authentication is required but the victim must visit the attacker-controlled page (UI:R). No public exploit code or active exploitation is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's PerformanceAPIs - the Performance, PerformanceObserver and performance timing interfaces - allows a remote, unauthenticated attacker who gets a victim to load a crafted HTML page to potentially execute arbitrary code outside the browser sandbox on Chrome builds prior to 156.0.8078.47. The only prerequisite is that the user navigate to (or be redirected to) attacker-controlled content (UI:R, PR:N), and changed-scope scoring drives the CVSS to 9.6 - a number that must be read alongside Google's own Chromium severity rating of Medium and the assessment's caveat that the sandbox escape is described as potential rather than confirmed. Vendor patch is available; no public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later via the built-in updater (Help > About Chrome triggers download and requires a browser relaunch) or by deploying the vendor installer from the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; confirm the running build at chrome://version, and note that Chrome's auto-update normally closes this window but only after the browser is restarted, so force a relaunch fleet-wide. Enterprises should pin and enforce the minimum version through Chrome Browser Cloud Management or their software distribution tooling and audit for hosts that have auto-update disabled. Where immediate upgrade is impossible, compensating controls are limited because the defect lives in a core web-exposed API that cannot be disabled: constrain users to allow-listed sites via URL blocklists or a managed proxy (breaks untrusted-web workflows and creates ongoing maintenance burden), keep Site Isolation at its default enabled state (it limits cross-origin data exposure from a compromised renderer but does not prevent this use-after-free), and run Chrome inside a dedicated low-privilege OS account or disposable VM for high-risk browsing so that a successful sandbox escape does not land on a privileged host profile.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Performance APIs are Blink/Chromium's JavaScript surface for the W3C Performance Timeline and Resource Timing specifications, exposing objects such as Performance, PerformanceEntry and PerformanceObserver to page script; this is a CWE-416 use-after-free, meaning an object backing those timing interfaces can be freed while page script still holds a live reference, producing a dangling pointer that is dereferenced on a subsequent API call. Triggering it requires the crafted page to drive the timing interfaces in a pattern that races object lifetime against garbage collection - typically through repeated entry observation, buffer manipulation or re-entrant callbacks - so the bug is deterministic only for an attacker who controls the page's script. The S:C score reflects that the vulnerable component (the renderer/Blink object) and the impacted component (the host OS outside the sandbox) differ, which is why code execution is described as 'outside the sandbox'; the independent assessment treats that escape as potential rather than demonstrated, so full host compromise should not be assumed. No CPE strings were supplied; EUVD records the affected range as Chrome builds earlier than 156.0.8078.47, and the Chromium tracking bug is issue 502251640.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must visit it (UI:R); claimed sandbox escape justifies S:C with full C/I/A:H, though AC could be H for a UAF race.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a use-after-free flaw in performance monitoring interfaces that could potentially let a remote attacker escape the browser sandbox and execute code on affected endpoints. Employees who browse the web using unpatched Chrome are exposed, creating risk of endpoint compromise, data loss, or follow-on lateral movement. Leadership should prioritize rapid browser remediation given the critical CVSS score, while weighing Google's own Medium severity rating and the absence of confirmed exploitation or public exploit code at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB