EUVD-2026-105537
GHSA-jc9q-g5f7-5qhh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage abuses FedCM API flow
-
ExecutionTrigger memory corruption (CWE-119)
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the FedCM (Federated Credential Management) feature path to be reachable - this is enabled by default in modern Chrome - and requires user interaction (UI:R): the victim must actively browse to attacker-controlled or attacker-injected HTML. No authentication or prior privileges are needed (PR:N). The key LIMITING factor is sandbox containment: the description states execution occurs 'inside the sandbox' (S:U, no scope change), so the attacker does NOT gain host-level code execution and must chain a separate sandbox-escape bug to break out. Exploitation is also bounded to Chrome versions prior to 156.0.8078.47; patched installations are not affected. |
| Impact | This is a genuinely elevated-priority issue, though not a top-tier emergency. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - the standard browser drive-by model. However, a critical mitigating signal is in the description itself: code execution occurs INSIDE the Chrome sandbox (S:U, no scope change), meaning a successful exploit does not by itself compromise the host OS and would need to be chained with a separate sandbox-escape bug for full system takeover. This tension is worth flagging: the 8.8 'High' CVSS and C:H/I:H/A:H impact metrics contrast with Chromium's own 'Medium' severity rating, which better reflects the sandbox containment. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code referenced, so there is no evidence of active exploitation - this is a proactively patched vendor-reported bug. Net: patch promptly given Chrome's ubiquity and the low-complexity remote vector, but the sandbox boundary makes this lower real-world risk than a comparable host-level RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious markup that abuses Chrome's FedCM (Federated Credential Management) implementation to trigger memory corruption. A victim running a vulnerable Chrome version (prior to 156.0.8078.47) visits the page, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified at the time of analysis, and full host compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's FedCM (Federated Credential Management) component allows a remote attacker to potentially execute arbitrary code within the browser sandbox when a victim visits a crafted HTML page, affecting all Chrome versions prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) and no authentication (PR:N), with publicly available patch details and vendor advisories published; no public exploit code or confirmed active exploitation is identified at time of analysis. Because code execution is contained inside the sandbox (S:U), impact is bounded - a separate sandbox-escape vulnerability would be required for host-level compromise.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; verify the installed version through chrome://version and enforce auto-update so the fixed build is applied without user action. Chromium-based browsers and Electron applications should be updated to a release rebased on Chromium 156.0.8078.47 or newer once their vendors publish it. As a compensating control where immediate upgrade is not possible, restrict browsing to trusted sites and enforce enterprise URL allow/block lists via Chrome Enterprise policies - trading off user flexibility for reduced exposure to attacker-supplied HTML; note that disabling FedCM through policy is not a documented, durable mitigation for this defect, so patching remains required. No vendor workaround beyond upgrading is identified in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-119 (improper restriction of operations within the bounds of a memory buffer), a memory-corruption class that in Chromium's multi-process architecture typically manifests as an out-of-bounds read/write in a renderer-side implementation. FedCM is the web API implementing Federated Credential Management, which brokers identity-provider assertions with the browser via browser-process-mediated dialogs and JavaScript-exposed interfaces; it is enabled by default in modern Chrome and reachable from ordinary web content. The affected surface is the Chrome/Chromium browser up to 156.0.8078.47, with the fix landing in the Stable channel release documented in Google's Chrome Releases advisory and tracked in Chromium issue 507227196 (access-restricted, per standard Chromium security practice). The severity assigned by Chromium is Medium, while the derived CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the confidentiality, integrity, and availability potential of arbitrary code execution in the renderer - but the unchanged scope (S:U) correctly captures that the compromise remains inside the sandbox.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user navigation (UI:R); scope unchanged because execution is confined to the renderer sandbox, with full renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 carry a high-severity flaw that could let a malicious webpage execute code inside the browser's protected environment, affecting employees who use unpatched Chrome for everyday web access. Exploitation requires user interaction and is bounded by the browser sandbox, so the immediate enterprise risk is localized browser compromise rather than broad host takeover; still, Chrome's ubiquity and the availability of a vendor fix make rapid fleet remediation a leadership priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB