EUVD-2026-105536
GHSA-wjj8-852c-jq9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger use-after-free in Input component
-
ExploitReclaim freed object via heap grooming
-
ExecutionHijack control flow
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to visit or be redirected to an attacker-controlled page containing crafted HTML that triggers the use-after-free in Chrome's Input component (reflected in CVSS UI:R). No authentication, special privileges, or non-default configuration is needed - default desktop Chrome prior to 156.0.8078.47 is affected. The key LIMITING factor is that resulting code execution is confined to the renderer sandbox: by itself this does not compromise the host OS, so a practical full-system attack must chain an additional sandbox-escape vulnerability. Required user interaction (navigating to the malicious page) and the sandbox boundary are the primary constraints reducing real-world severity below the raw 8.8 score. |
| Impact | Signals are mixed and must be weighed carefully. The NVD CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R, indicating a network-reachable, low-complexity, unauthenticated flaw that requires only that a user visit a malicious page - a classic drive-by browser bug profile. However, two factors temper the raw score: (1) Google's own Chromium security team rated the severity as Medium, not High/Critical, and (2) the description explicitly states code execution occurs 'inside the sandbox,' meaning a successful exploit alone does NOT yield host compromise - it would need to be chained with a separate sandbox-escape vulnerability to be fully weaponized. This sandbox constraint is not reflected in the S:U/C:H/I:H/A:H impact metrics, which arguably overstate real-world impact for an isolated renderer-process UAF. EPSS is not provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC referenced, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Net assessment: a legitimate patch-soon browser memory-corruption bug, but absent KEV/POC/EPSS signals and given the Medium vendor rating plus sandbox containment, this is a routine-priority Chrome update rather than an emergency. The CVSS 8.8 vs. Chromium 'Medium' discrepancy should be noted to stakeholders - verify against vendor advisory before escalating. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers a use-after-free in Chrome's Input component when a victim browses to it. By grooming the heap, the attacker reclaims the freed object to gain control of execution flow and run arbitrary code within the renderer sandbox. No public proof-of-concept is referenced, and full system compromise would additionally require chaining a separate sandbox-escape bug; attack complexity is low but user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page (CVSS 8.8, UI:R). The raw score is high, but the independent assessment notes that code execution is confined to the renderer; full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or CISA KEV entry was identified at time of analysis, so risk signals are mixed and should be weighed with the user-interaction and sandbox constraints.
RemediationAI
Vendor-released patch: 156.0.8078.47. Upgrade Google Chrome to 156.0.8078.47 or later and restart the browser so the new binary is active; verify the version via chrome://settings/help or enterprise version reporting. The vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, with the underlying Chromium bug at https://issues.chromium.org/issues/506152584. No specific configuration workaround is documented in the provided references, so patching is the primary remediation. As compensating controls until deployment, keep the Chrome sandbox enabled (never launch with --no-sandbox or disable renderer sandboxing), restrict browsing to trusted sites where feasible, and monitor for renderer crashes that may indicate exploitation attempts; these reduce exposure but do not remove the vulnerability, and restricting sites has productivity trade-offs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Input component, which handles input-event processing in the browser/renderer pipeline. A use-after-free occurs when an object is freed but a stale pointer is later dereferenced; by crafting an HTML page that drives specific input/event sequences, an attacker can cause memory reuse and potentially redirect execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack that requires the user to load the page, with high confidentiality, integrity, and availability impact within the affected component. Tags also flag memory corruption and denial of service, consistent with a UAF that can crash the renderer as well as enable code execution. The renderer sandbox is the key boundary: exploitation yields code execution inside the sandbox, not host-level access by itself. EUVD lists Chrome versions below 156.0.8078.47 as affected; no CPE strings were provided.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; user must visit the page so UI:R; renderer-sandbox code execution keeps scope S:U with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 156.0.8078.47 contain a high-severity use-after-free flaw that could allow a crafted webpage to execute code within the browser's renderer sandbox, affecting any employee who visits malicious or compromised sites. The sandbox confines code execution to the renderer, and with no public exploit identified at time of analysis, the widespread use of Chrome still means leadership should prioritize rapid patching to limit exposure. Full host compromise would require an additional sandbox-escape vulnerability, so the immediate organizational risk is contained but still warrants attention.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB