EUVD-2026-105546
GHSA-2vmc-fxcq-2xv4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Chrome API
-
ExecutionCorrupt memory and hijack control flow
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content - a crafted HTML page rendered by Google Chrome prior to 156.0.8078.47 (UI:R, user interaction required); no authentication is needed (PR:N). The key LIMITING factor is that resulting code execution is confined to the Chrome renderer sandbox: the attacker gains control inside the sandboxed process only, and escaping to the host OS requires a separate sandbox-escape vulnerability. Affects only unpatched Chrome versions below 156.0.8078.47; no non-default configuration is required. |
| Impact | CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R, indicating a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page. However, several signals temper this: the Chromium team rated the security severity only Medium, and the description explicitly states code execution occurs 'inside the sandbox' - meaning this alone does not yield host compromise without a separate sandbox-escape vulnerability (scope is correctly S:U, not changed). No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active exploitation or weaponization. The UI:R requirement (user must visit a malicious page) further reduces mass-exploitation likelihood versus a zero-click bug. Net assessment: this is a standard-urgency browser patch - worth prompt deployment because Chrome is ubiquitous and memory-corruption bugs are routinely chained, but the sandbox containment and Medium Chromium rating argue against treating it as a drop-everything emergency. The gap between the 8.8 CVSS and the Medium vendor rating is driven by CVSS not modeling the renderer sandbox boundary; defenders should weight the vendor's Medium rating and the sandbox limitation. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or compromises/ad-injects into a site the victim visits) that triggers a use-after-free in a Chrome API, corrupting memory to execute arbitrary code within the renderer sandbox. No public exploit is identified at time of analysis, and full system compromise would require chaining this with a separate sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's API layer allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in versions prior to 156.0.8078.47. CVSS 3.1 is 8.8 (High) with UI:R, while Chromium rates it Medium because code execution remains confined to the sandbox and host compromise requires a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fix.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47. Upgrade to that version or later and restart the browser, then verify the installed version via chrome://version. Enterprise administrators should force the update through Chrome Enterprise policies or their software deployment tooling; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is https://issues.chromium.org/issues/513452101. No product-level workaround was identified in the supplied data; if immediate patching is impossible, reduce exposure by limiting browsing to trusted sites, isolating Chrome in a disposable VM or remote browsing session, and blocking untrusted HTML at the network gateway, accepting reduced usability and incomplete protection. Do not disable the renderer sandbox, since it is the containment boundary that limits this bug to in-sandbox code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's API handling. In Chrome's multi-process architecture, a crafted HTML page can cause a freed object to be referenced again, leading to memory corruption and potentially arbitrary code execution within the renderer process. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the renderer sandbox is the key containment boundary: the supplied assessment states that code execution is confined to the sandboxed process and that escaping to the host requires a separate sandbox-escape vulnerability. This explains the difference between the 8.8 CVSS base score and Chromium's Medium severity rating. The supplied intelligence does not identify the specific API involved or provide CPE strings for exact build mapping.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N/AC:L/PR:N) requires the victim to open the page (UI:R); code runs within the sandbox so scope is unchanged (S:U), with high renderer-process impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome installations below version 156.0.8078.47 carry a high-severity browser flaw that could allow a malicious web page to run code inside Chrome's renderer sandbox. Leadership should care because Chrome is broadly deployed and user browsing is a routine attack path, but sandbox confinement limits host-level compromise and no public exploit identified at time of analysis, making rapid patching the key risk reducer.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB