EUVD-2026-105561
GHSA-f7g9-wvmc-3959
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage manipulates WindowControlsOverlay objects
-
ExploitTrigger use-after-free (CWE-416)
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to navigate to an attacker-crafted HTML page that exercises the WindowControlsOverlay feature (a desktop/PWA window-controls API), triggering the use-after-free; this maps to the CVSS UI:R requirement - there is no drive-by without user navigation. The critical limiting factor is that resulting code execution is confined to the renderer sandbox: without a separate sandbox-escape vulnerability, the attacker cannot directly compromise the host operating system, substantially reducing real-world impact versus an unsandboxed RCE. |
| Impact | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated memory-corruption flaw requiring only that a victim open a crafted page - a classic high-severity browser profile. However, two signals temper this: Google/Chromium rated the issue 'Medium' severity, and the description explicitly states code execution occurs 'inside the sandbox,' meaning a successful exploit is contained by Chrome's renderer sandbox and would require chaining with a separate sandbox-escape to achieve full host compromise. No EPSS score, KEV listing, or POC was provided in the input; per the data, there is no public exploit identified at time of analysis and no evidence of active exploitation. The divergence between the 8.8 CVSS and the vendor's Medium rating is best explained by the sandbox containment the base vector does not capture. Net assessment: a legitimate patch-now item for an ubiquitously deployed product, but not a drop-everything emergency absent an exploit chain or KEV listing - prioritize via normal rapid Chrome update cycles. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that abuses the WindowControlsOverlay feature to trigger a use-after-free in Chrome. When a victim running a pre-156.0.8078.47 build visits the page, the freed object is reused to execute attacker-controlled code within the renderer sandbox. No public exploit code was identified in the provided data, and full system compromise would additionally require a sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Sandboxed code execution in Google Chrome versions prior to 156.0.8078.47 is possible through a use-after-free flaw in the WindowControlsOverlay component, which a remote, unauthenticated attacker can trigger by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields arbitrary code execution, but strictly within the renderer sandbox - the attacker gains no direct access to the host operating system without chaining a separate sandbox-escape bug, which is why Google rates the issue only Medium in its own severity scheme. Google has shipped a vendor fix in Chrome 156.0.8078.47; no public exploit code or confirmed active exploitation was identified at time of analysis, and the attack is not drive-by - it requires deliberate user navigation to attacker-controlled content.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, deployed through the browser's built-in updater (chrome://settings/help triggers an immediate check) or through enterprise update policies such as Chrome Browser Cloud Management, Google Update, or your software distribution tooling; verify the reported version string rather than assuming auto-update completed, since staged rollouts can leave endpoints behind for days. Organizations running Chromium-derived browsers should track their vendor's rebase to the 156.0.8078.47 milestone separately. If immediate fleet-wide patching is not possible, the highest-value compensating control is to constrain exposure to the attack prerequisite: block or tightly allowlist untrusted web content through your secure web gateway or DNS filtering, since exploitation requires the user to navigate to the crafted page - the trade-off is reduced user flexibility and potential breakage of legitimate sites, and filtering is bypassable by determined attackers. Restricting or disabling Progressive Web App installation and Window Controls Overlay usage via enterprise policy reduces the reachable surface but does not eliminate the underlying renderer flaw and may disrupt line-of-business PWAs. Keep Chrome's site isolation and sandbox enabled (never launch with --no-sandbox) as the control that keeps this flaw contained to the renderer, and treat any post-exploitation host compromise as evidence of a chained sandbox escape rather than this CVE alone. Advisory references: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://issues.chromium.org/issues/514066540.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) inside Blink's Window Controls Overlay implementation, a desktop/PWA API that lets an installed web app draw its own title bar and take over the window-controls region of the browser frame. Because the overlay couples DOM-visible geometry with browser-side window frame objects, a lifecycle mismatch - a frame, widget, or overlay controller freed while still referenced after a resize, overlay-visibility toggle, or teardown - leaves a dangling pointer that attacker-influenced script can reshape on the renderer heap. This is a classic browser memory-corruption primitive: heap grooming through scripted DOM operations converts the dangling reference into controlled data, and from there into instruction-pointer control inside the Chrome renderer process. Critically, the corruption lives in the renderer, so code execution lands inside the sandbox; the CVSS vector's S:U scope and the independent assessment both confirm that host compromise requires a second, independent sandbox-escape vulnerability. The UI:R component reflects that the victim must actually load the crafted page - there is no zero-click path. Google's Chromium security severity of Medium, versus the 8.8 NVD-style score, reflects this containment plus the user-interaction prerequisite.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted web page is network-reachable with no auth (AV:N/PR:N) but needs the victim to open it (UI:R); code runs within the sandbox so scope is unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity use-after-free in WindowControlsOverlay that can allow an unauthenticated remote attacker to execute code inside the browser renderer sandbox when a user opens crafted HTML. The primary organizational exposure is workforce browsers rather than direct host compromise, since escaping the sandbox would require a separate vulnerability, but unpatched endpoints still create patch-management and incident-response risk. Leadership should care because broad Chrome use means remediation must be coordinated quickly, even though no public exploit or confirmed active exploitation was identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB