EUVD-2026-105587
GHSA-f849-m96f-pr56
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryServe crafted HTML to WebUI component
-
ExploitTrigger memory corruption (CWE-119)
-
ExecutionExecute arbitrary code within renderer sandbox
-
ImpactAttempt chaining to sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome desktop build prior to 156.0.8078.47 and to be induced to load attacker-controlled crafted HTML that reaches the WebUI component (UI:R - user interaction is mandatory, so this is not a zero-click flaw). No authentication is needed (PR:N) and no special non-default configuration is indicated. Critically, successful exploitation yields code execution only 'inside the sandbox' (S:U), so full host compromise additionally requires a separate, un-named sandbox-escape vulnerability - this containment is the primary limiting factor on real-world impact. |
| Impact | This is a credible but context-limited priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction (visiting a crafted HTML page) - the classic drive-by browser profile. However, the description explicitly scopes code execution to 'inside the sandbox,' and the CVSS scope is Unchanged (S:U), meaning this is a renderer/WebUI-tier compromise, NOT a confirmed sandbox escape or full host takeover; the C:H/I:H/A:H ratings reflect worst-case in-sandbox impact rather than OS-level control. Notably, Google rated the Chromium security severity only 'Medium,' which contrasts with the 8.8 'High' CVSS - the Chromium rating accounts for the sandbox containment, so the raw CVSS overstates real-world severity for an isolated bug. EPSS is not provided, KEV status is not listed (no active exploitation), and no POC is referenced, so exploitation likelihood signals are absent. Net assessment: patch-worthy and typical of Chrome's regular security cadence, but absent a chained sandbox escape this is a moderate, not emergency, priority - treat as 'patch in the normal fast-track browser cycle' rather than 'drop everything.' |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption bug in Chrome's WebUI component when a victim using a vulnerable version (prior to 156.0.8078.47) visits it. Low attack complexity and no authentication are required, but the victim must be lured into loading the malicious page (UI:R), and resulting code execution is confined to the browser sandbox unless chained with a separate escape. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's WebUI component before version 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim is induced to load a crafted HTML page. Exploitation requires user interaction (UI:R) and no special configuration; successful code execution is confined to the sandbox unless chained with a separate sandbox-escape vulnerability, which limits real-world host compromise. A vendor patch is available in Chrome 156.0.8078.47, and no public exploit or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47. Upgrade affected desktop installations to 156.0.8078.47 or later, then fully restart the browser so the new binary is loaded; verify the version from chrome://settings/help or the browser's about page. Enterprise fleets should enforce the update through Chrome auto-update policies or their software distribution tooling and confirm compliance across managed endpoints. No practical workaround is documented because WebUI is an integral browser component; disabling it would break core browser functionality and is not a viable mitigation, so patching is the primary control. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html for release details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer in Chromium's WebUI layer, the framework used to render privileged internal browser pages such as chrome:// surfaces. A crafted HTML page that reaches the vulnerable WebUI code can corrupt memory and redirect execution within the renderer process. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms a network-reachable, unauthenticated attack that requires victim interaction, with high confidentiality, integrity, and availability impact but unchanged scope. That S:U containment is significant: code execution occurs inside the Chrome sandbox, so full host compromise would require an additional, unnamed sandbox-escape primitive. Google assigned this issue Chromium security severity Medium even though the supplied vector scores 8.8, reflecting the sandbox-limited impact and mandatory user interaction.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network drive-by via crafted HTML (AV:N/AC:L/PR:N) needs victim page load (UI:R); impact is high but sandbox-contained with no scope change (S:U), matching the stated vendor data.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's WebUI component contains a memory corruption vulnerability that could allow a remote attacker to run code inside the browser sandbox if an employee is tricked into loading a malicious webpage, putting any unpatched Chrome user at risk. Because Chrome is widely deployed, even sandbox-limited code execution can threaten productivity and create a potential beachhead for further attacks, though no public exploit has been identified. Leadership should treat this as a manageable but urgent patching priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB