EUVD-2026-105538
GHSA-jxf6-pc2w-79mr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalicious script invokes Performance APIs
-
ExecutionTrigger input-validation flaw in renderer
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to actively load a crafted HTML page in a vulnerable Chrome build (any version prior to 156.0.8078.47); this user interaction (UI:R) is the primary limiting factor since the attacker cannot trigger it unprompted. No authentication or special configuration is needed - it affects default Chrome installations with the Performance APIs feature, which is standard browser functionality. The key containment factor is that successful exploitation yields code execution only within the renderer sandbox; achieving host-level compromise requires chaining a separate sandbox-escape vulnerability, substantially raising the bar for full impact. |
| Impact | Signals are mixed and must be read carefully. NVD assigns CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which rates this as High, yet Google's own Chromium severity is only Medium - a meaningful divergence. The reconciling factor is in the description: code execution is confined 'inside the sandbox,' meaning this is a renderer-process compromise, not full host takeover. On its own it does not escape Chrome's sandbox, so weaponizing it for system-level RCE would require chaining a separate sandbox-escape bug; the CVSS C:H/I:H/A:H therefore overstates real-world impact relative to the Medium vendor rating. No EPSS score, KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: patch promptly because Chrome is near-universal and the bug is network-reachable with no privileges, but this is not an emergency single-bug RCE - realistic severity sits between the NVD High and the vendor Medium, closer to Medium given sandbox containment. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that abuses improper input validation in Chrome's Performance APIs. A user with a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, triggering memory corruption that lets the attacker run arbitrary code within the renderer sandbox. No public exploit code is identified at time of analysis, and full host compromise would require an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Arbitrary code execution inside the renderer sandbox is possible in Google Chrome before 156.0.8078.47 because PerformanceAPIs improperly validate attacker-controlled input from a crafted HTML page. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no privileges required, but exploitation requires the victim to load the page and remains confined to the renderer unless chained with a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, and Google has released a fixed build.
RemediationAI
Vendor-released patch: 156.0.8078.47. Upgrade Google Chrome to 156.0.8078.47 or later through the normal auto-update channel or a vendor package, then restart the browser and verify the version at chrome://version. Apply the same minimum version across managed fleets and prioritize users who browse untrusted content. If upgrading is not immediately possible, note that Chrome does not expose a documented policy or setting to disable PerformanceAPIs specifically; disabling JavaScript would block the crafted-page vector but breaks most web applications. Keep the renderer sandbox and Site Isolation enabled, isolate high-risk browsing to a hardened or remote browser, and use URLBlocklist or secure web gateway controls only as partial containment against known malicious pages, not as a general fix. Track the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue at https://issues.chromium.org/issues/511311494.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PerformanceAPIs refers to Chrome's web-exposed performance measurement interfaces, including Navigation Timing, Resource Timing, User Timing, PerformanceObserver, and related methods, which pass page-controlled data into browser-native code. CWE-20 indicates the root cause is missing or insufficient validation of that input, allowing a crafted page to drive the native implementation into an unsafe state and achieve code execution inside the renderer process. The renderer sandbox contains the impact to the browser process boundary; host-level compromise would require an independent sandbox-escape vulnerability. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a network-reachable, unauthenticated attack that needs victim interaction, with high impact to confidentiality, integrity, and availability. Chromium's own severity rating is Medium, which is notably lower than the 8.8 CVSS score, so severity interpretation should weigh the sandbox containment and user-interaction requirement. No CPE strings were supplied; EUVD lists Chrome 156.0.8078.47 with a <156.0.8078.47 range notation, which aligns with the vendor's prior-to-156.0.8078.47 statement.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote, no privileges, but requires visiting a crafted page (UI:R); scope unchanged and impact rated high within the renderer, though sandbox containment arguably caps real impact lower (vendor rates Medium).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome deployments older than 156.0.8078.47 create a high-severity endpoint risk: a crafted web page can trigger arbitrary code execution inside the browser’s renderer sandbox. The browser sandbox limits standalone impact, but Chrome’s broad footprint means unmanaged or delayed updates can leave many users exposed; no public exploit identified at time of analysis. Leadership should care because successful exploitation could affect user data and productivity on affected endpoints, while the vendor has provided a fixed build that reduces exposure through normal patch management.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB