EUVD-2026-105564
GHSA-x655-q9hg-232j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious page registers/abuses ServiceWorker
-
ExploitTrigger use-after-free in freed object
-
ExecutionGroom heap and reclaim object
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome desktop build prior to 156.0.8078.47 and to load attacker-controlled HTML content (UI:R - the user must navigate to or render the crafted page), after which no authentication is needed (PR:N). The flaw lives in ServiceWorker object lifetime handling, so the crafted page must exercise that code path. A key LIMITING factor: the description scopes code execution to 'inside the sandbox' (S:U), so arbitrary code runs in the constrained renderer process and a separate sandbox-escape vulnerability would be required to compromise the host OS; no special non-default browser configuration is indicated. |
| Impact | Signals are mostly consistent toward a serious but not top-tier priority. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, which fits a drive-by 'visit a malicious page' browser bug. However, note the tension between the numeric score and vendor triage: Google's Chromium team rated this 'Medium' severity, and the description explicitly scopes code execution to 'inside the sandbox' (S:U, no scope change), meaning a separate sandbox-escape chain would be needed for full host compromise - so the real-world impact is lower than the 8.8 Critical-adjacent number suggests. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Use-after-free renderer bugs in Chrome are historically exploitable and sometimes reach KEV, but nothing here confirms active or demonstrated exploitation. Net: a real patch-promptly item for any Chrome fleet, but absent KEV/EPSS/POC evidence it should be treated as routine browser patch hygiene rather than an emergency, and the sandbox-confined impact tempers the CVSS 8.8. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that abuses ServiceWorker handling to trigger the use-after-free. When a victim running a vulnerable Chrome build (before 156.0.8078.47) visits the page, the freed object is reclaimed and manipulated to achieve arbitrary code execution within the renderer sandbox. Low attack complexity (AC:L) makes triggering reliable once the victim navigates, though user interaction (UI:R) is required and no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's ServiceWorker implementation affects desktop Chrome builds prior to 156.0.8078.47 and can let a remote attacker execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. The issue is rated CVSS 8.8 with UI:R and PR:N, so exploitation depends on user navigation rather than credentials; the code-execution impact is constrained to the sandboxed renderer, and a separate sandbox escape would be needed to compromise the host OS. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
RemediationAI
Upgrade Google Chrome desktop to 156.0.8078.47 or later, then restart the browser and verify the installed version; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is https://issues.chromium.org/issues/514372708. For managed fleets, force the update through the enterprise browser management channel and confirm that older builds are not pinned. If immediate upgrade is not possible, reduce exposure by restricting users to trusted sites and blocking untrusted HTML/JavaScript at the network gateway, but treat this as a partial mitigation: it does not fix the ServiceWorker use-after-free, can break legitimate web applications, and leaves users vulnerable if they reach crafted content. Keep the Chrome sandbox enabled and maintain OS-level exploit mitigations, which limit the consequences of renderer compromise but do not remediate the underlying memory-safety flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's ServiceWorker subsystem. ServiceWorker is the web-platform API that lets sites register background scripts to handle fetch events, caching, offline behavior, push notifications, and related lifecycle events; because those objects are reference-counted and manipulated across asynchronous event dispatch, a lifetime-handling error can leave a dangling pointer that is reused after the object is freed. In this case, a crafted HTML page that exercises the vulnerable ServiceWorker path can corrupt renderer memory and potentially achieve arbitrary code execution. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity attack that needs user interaction and no privileges, with high confidentiality, integrity, and availability impact but unchanged scope: the compromise is confined to Chrome's renderer sandbox, so host compromise requires an additional sandbox-escape vulnerability. Chromium rated the issue Medium, which is consistent with the sandboxed impact and required user action rather than with a host-level compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim navigation needed (UI:R); low complexity and high renderer-process C/I/A, with S:U reflecting sandbox-confined execution.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop deployments below 156.0.8078.47 represent a high-priority patching obligation because a malicious webpage could allow code execution within the browser sandbox for affected users. The business exposure is broadest for workforce endpoints where Chrome is the default browser and employees routinely browse external sites, creating potential for operational disruption or a stepping stone to deeper compromise. Although no public exploit identified at time of analysis, the vendor fix is available now and delayed browser remediation leaves a large, user-driven attack surface open.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB