EUVD-2026-105549
GHSA-4h5v-g933-32m4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger use-after-free in Extensions component
-
ExploitReclaim freed object to corrupt memory
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user running Google Chrome prior to 156.0.8078.47 to load an attacker-controlled HTML page (UI:R / UI interaction is mandatory - no exploitation without the victim visiting the page); no authentication or prior privileges are needed (PR:N). The flaw resides in the Extensions component and is reachable from standard web content. The principal limiting factor is containment: per the description, arbitrary code execution occurs INSIDE the renderer sandbox (S:U), so this alone does not compromise the host OS - a chained sandbox-escape bug would be required for full system takeover. Users on auto-updating Chrome channels will be remediated without manual action. |
| Impact | This is a genuine high-priority browser flaw but with an important impact caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms a low-complexity, network-reachable, unauthenticated path requiring only that a victim visit a crafted HTML page - the classic drive-by profile that makes browser UAF bugs attractive. However, the description explicitly states code execution occurs 'inside the sandbox,' and the vector's S:U (scope unchanged) is consistent with that: on its own this yields control of the renderer process, not the host, so practical full system compromise requires chaining a separate sandbox escape. Note the signal tension here: the aggregated CVSS is 8.8 (High), yet Chromium's own security triage rated this Medium - the discrepancy reflects that NVD-style scoring treats renderer C:H/I:H/A:H as full impact while Google weights the sandbox containment. No EPSS score was provided, there is no CISA KEV listing, and no public exploit (POC) is indicated, so exploitation status is: no public exploit identified at time of analysis. Prioritize patching because of the ubiquitous footprint and trivially-triggered vector, but the absence of KEV/POC and the sandbox confinement argue this is not yet an actively-weaponized emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's Extensions subsystem, then lures a victim (via phishing link, malvertising, or watering-hole) to open it in an unpatched browser. When the page loads, the freed object is reused to corrupt memory and execute attacker-controlled code within the renderer sandbox. No public exploit code is identified at time of analysis, and meaningful host compromise would require chaining this with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page execute arbitrary code within the renderer sandbox. The CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact, but per Google (Chromium severity: Medium) code execution is contained inside the sandbox, so host compromise requires chaining a separate sandbox-escape flaw; no authentication is needed but user interaction is mandatory. No public exploit code or confirmed active exploitation was identified at time of analysis, and users on auto-updating channels are remediated without manual action.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - vendor-released patch: 156.0.8078.47 - and restart the browser so the new build takes effect; Chrome on its default update channels should pick this up automatically. Verify the installed version in chrome://settings/help before assuming remediation. Chromium-derived browsers and applications embedding the Chromium runtime should apply the corresponding upstream fix from issue 513512147 rather than relying on Chrome's release. Where immediate patching is not possible, the actionable compensating control is to constrain the Extensions attack surface: disable or block untrusted and side-loaded extensions via ExtensionSettings/ExtensionInstallBlocklist policy and, in managed fleets, restrict extension installation to an allowlist - the trade-off is that users lose the blocked extensions' functionality. Because exploitation requires the victim to load a crafted page, URL filtering and phishing-resistant browsing controls reduce exposure but do not eliminate the flaw; they add latency and false positives. Note that these workarounds contain risk rather than fix the memory-safety defect, and none of them address the use-after-free itself. Advisory: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a memory-safety defect of class CWE-416 (use after free) in Chrome's Extensions subsystem, which parses and manages extension content, bindings, and messaging surfaces that are exposed to ordinary web pages. A dangling pointer to freed memory can be reclaimed with attacker-influenced data, giving a controlled-write or control-flow primitive inside the renderer process. Because the vulnerable path is reachable from standard web content, the attack vector is network-based (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but the victim must load an attacker-supplied HTML page (UI:R). The scope is unchanged (S:U) and the description explicitly places the resulting arbitrary code execution inside the sandbox, so the primitive applies to the compromised renderer, not the host operating system; escaping the sandbox would demand an independent vulnerability. CPE-level detail was not provided; the affected range per EUVD is Chrome versions below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page trigger (AV:N/AC:L/PR:N) requiring a victim visit (UI:R); code runs in the renderer sandbox without crossing a trust boundary (S:U), with full renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome users on builds prior to 156.0.8078.47 face a high-severity browser flaw that could allow attacker-controlled code to run within Chrome's renderer sandbox, though host compromise would require an additional sandbox-escape issue. Leadership should care because Chrome is widely deployed across the workforce, but no public exploit identified at time of analysis and a vendor patch is available, so prioritized updating can reduce exposure without emergency disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB