EUVD-2026-105541
GHSA-gmjx-8rmr-rp5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Variations
-
ExecutionReclaim freed object to control memory
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build prior to 156.0.8078.47 (UI:R / UI:P - user must navigate to attacker-controlled content, e.g., via phishing, malvertising, or a compromised site); no authentication or special configuration is needed since Variations is a built-in Chrome component active in default installs. The decisive limiting factor is sandbox containment: successful exploitation yields code execution only inside the renderer sandbox, so impact beyond the sandboxed process requires chaining a separate sandbox-escape vulnerability. Mitigation is immediate for any instance already updated to 156.0.8078.47 or later. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that the victim load attacker-controlled web content - a classic drive-by profile. However, this signal conflicts with Google's own Chromium severity rating of Medium, and the discrepancy is explained by the description's key qualifier: code execution occurs 'inside the sandbox.' Chrome's renderer sandbox contains the compromised process, so without a chained sandbox-escape this UAF yields renderer-level compromise rather than full host takeover, which materially lowers real-world impact below what the 8.8 score suggests. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a patch-promptly browser memory-corruption bug on a ubiquitous product (real priority for fleet patching) but not an emergency single-bug RCE, because sandbox containment and the lack of any exploitation signal argue against widespread immediate weaponization. EPSS/KEV/POC data being absent is a gap, not a contradiction - treat exploitation likelihood as currently unestablished. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's Variations component when a victim browses to it. Exploitation of the freed object corrupts memory to achieve arbitrary code execution within the renderer sandbox; full host compromise would additionally require a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote code execution inside the renderer sandbox affects Google Chrome builds prior to 156.0.8078.47, where a use-after-free in the Variations component can be triggered by a crafted HTML page. Exploitation requires the victim to navigate to attacker-controlled content (UI:R), but no authentication or special configuration is needed; the resulting code execution is confined to the sandbox, so crossing a security boundary depends on chaining a separate sandbox-escape flaw. No public exploit code was identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later; this is the vendor-released patch and the complete fix, available through Chrome auto-update or enterprise deployment, and verifiable at chrome://version. See the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. If immediate update is not possible, reduce exposure by restricting browsing to trusted sites and isolating Chrome in a low-privilege environment, but these are compensating controls only and do not remove the use-after-free; disabling the Variations feature is not a supported end-user mitigation and may alter feature behavior. No vendor workaround was provided in the input.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-416 (use-after-free) in Chrome's Variations component, which handles field-trial and feature-flag configuration. A use-after-free occurs when an object is freed but later dereferenced; in a browser renderer this can corrupt memory and redirect execution. The crafted HTML page supplies the trigger, and because Variations is a built-in component in default Chrome installs, no special configuration is required. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network delivery, low attack complexity, no privileges, and user interaction, with high confidentiality and integrity impact; the assessed scope remains the sandboxed renderer, so full host compromise requires a separate sandbox escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted web page gives AV:N/AC:L/PR:N, victim navigation gives UI:R; code stays in the renderer sandbox so S:U, with high C/I/A within that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity memory corruption vulnerability that allows attacker-supplied web content to execute code inside the browser's renderer sandbox. The flaw is remotely triggerable when a user visits a malicious or compromised page, exposing the general workforce during routine browsing, though full system compromise would require chaining a separate sandbox escape. Leadership should prioritize rapid patching because Chrome is universally deployed and the update is already available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB