EUVD-2026-105590
GHSA-2gqx-qh9f-8gj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in BFCache
-
ExecutionCorrupt renderer memory structures
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to navigate to or load attacker-controlled HTML in Chrome versions prior to 156.0.8078.47, and the Back/Forward Cache (BFCache) code path must be exercised - BFCache is enabled by default in modern Chrome. The key limiting factor is UI:R: no server-side or passive compromise occurs without the user visiting/interacting with the malicious page. A further significant limiter is that code execution is contained within the renderer sandbox; achieving full host compromise would require chaining an additional sandbox-escape vulnerability not covered by this CVE. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a remote, low-complexity, unauthenticated memory-corruption flaw (CWE-119) requiring only that a victim visit a crafted HTML page, yielding a high base score of 8.8. However, several signals temper the real-world urgency. First, Chromium itself rated the security severity only 'Medium', and critically the description states code execution occurs 'inside the sandbox' - i.e., the renderer process - so without a chained sandbox-escape this is not a full host compromise, which is why scope is Unchanged (S:U). Second, there is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis'; the C:H/I:H/A:H impacts therefore reflect theoretical worst-case within the sandbox rather than demonstrated full-system takeover. No EPSS score was supplied, so exploitation probability cannot be quantified. The main amplifying factor is prevalence: Chrome is ubiquitous, and browser renderer bugs are routinely chained with escapes by sophisticated actors, so this should be patched promptly as part of normal Chrome update hygiene, but on current evidence it is a high-CVSS, patch-on-cycle issue rather than a confirmed emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that abuses the Back/Forward Cache (BFCache) to trigger memory corruption in the Chrome renderer. A victim is lured to visit the page (UI:R), and the attacker achieves arbitrary code execution confined to the browser sandbox. No public exploit code was identified at the time of analysis; real-world impact typically requires chaining with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Back/Forward Cache (BFCache) component of Google Chrome allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and full confidentiality/integrity impact within the compromised renderer, but user interaction is mandatory and code execution remains contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape flaw that this CVE does not provide. No public exploit code or confirmed active exploitation was identified at time of analysis; Google rates the issue Chromium security severity Medium and has released a stable-channel fix.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47, published in the Stable Channel Update for Desktop (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). Update via chrome://settings/help and fully restart the browser - a restart is required because the patch only takes effect in newly spawned browser/renderer processes - or push the fixed package through your OS/enterprise package manager and verify the reported version is 156.0.8078.47 or later. Chromium-based third-party browsers should be updated once their maintainers adopt the same or a later Chromium baseline; confirm their release notes rather than assuming parity. If immediate fleet-wide patching is not possible, the highest-value compensating control is not technical but procedural: because exploitation requires the victim to load attacker-controlled HTML, block or warn on untrusted navigation (URL filtering, Safe Browsing enforcement, disabling unsupervised browsing on high-value endpoints), accepting the trade-off of reduced user flexibility. Removing BFCache would neutralize this specific code path but is no longer exposed as a supported user-facing flag in current Chrome builds, so it is not a dependable mitigation and would also measurably degrade Back/Forward navigation performance. Keep Chrome's renderer sandbox and Site Isolation enabled as defense-in-depth - they do not prevent this memory corruption but contain post-exploitation code execution to the renderer process, buying time for patch deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BFCache is a Chromium navigation optimization that keeps a fully rendered page alive in memory - including its DOM tree, JavaScript heap, and event listeners - so that Back and Forward navigations restore instantly instead of re-fetching and re-executing the document. Because a BFCache'd page is frozen and later revived in place, the serialization, eviction, and restoration code paths handle complex, partially-torn-down renderer state, which is precisely where lifetime and bounds errors are easy to introduce. This CVE is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), i.e. an out-of-bounds read/write corrupting renderer heap memory when the BFCache path processes a maliciously constructed document. The attacker-supplied HTML drives the corruption; a successfully corrupted renderer heap can be leveraged for arbitrary code execution within the renderer process, but the Chromium sandbox (site isolation, renderer privilege separation) constrains the blast radius to that sandboxed process. The affected component is Chrome desktop prior to 156.0.8078.47, tracked as EUVD-2026-105590 and documented in the Chrome Stable Channel Update for Desktop and Chromium issue 520017400.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the victim to visit it (UI:R); code runs in the sandboxed renderer so scope is Unchanged with high in-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's Back/Forward Cache component has a high-severity memory-corruption flaw affecting Chrome builds prior to 156.0.8078.47, creating a browser-session risk for employees who visit crafted or compromised web pages. Exploitation requires user interaction and is contained by Chrome's renderer sandbox, so full device compromise would require a separate sandbox-escape flaw; no public exploit identified at time of analysis. Leadership should prioritize fleet-wide Chrome updating because the product is broadly deployed and the vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB