EUVD-2026-105596
GHSA-4hhq-76jj-2vfv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Actor
-
ExecutionReclaim freed object, corrupt memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML content in Chrome prior to 156.0.8078.47 - the CVSS UI:R and the description's 'crafted HTML page' confirm active user interaction (navigating to or rendering the malicious page) is mandatory; it is not a zero-click flaw. No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected. The key LIMITING factor is sandbox confinement: the description states code executes 'inside the sandbox,' so this vulnerability alone cannot compromise the host and must be chained with a sandbox escape for full impact. Patching to 156.0.8078.47 or later eliminates the condition. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a realistic bar for a browser. However, the Chromium team self-rated the security severity as Medium, and the description explicitly states code execution occurs 'inside the sandbox' (consistent with S:U, no scope change), meaning this bug alone does NOT yield host compromise - it requires a chained sandbox escape to be fully weaponized, which materially lowers standalone real-world risk versus the 8.8 score. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no positive signal of active or imminent exploitation; absence of these is not proof of safety but there is nothing to elevate urgency beyond routine browser patching. Note the tension to verify: the quantitative 8.8 (High) conflicts with the vendor's qualitative 'Medium' rating, largely explained by the sandbox-confinement caveat the CVSS base metrics do not capture. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page (e.g., via a compromised ad, phishing link, or watering-hole site) that triggers the use-after-free in Chrome's Actor component when the victim's browser renders it. Reclaiming the freed object allows the attacker to corrupt memory and execute arbitrary code within the renderer sandbox; full system compromise would additionally require chaining a separate sandbox-escape vulnerability. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A use-after-free in Chrome's Actor component affects versions prior to 156.0.8078.47, allowing remote code execution inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (UI:R, PR:N) requires the target to navigate to or render attacker-controlled content in a default configuration, and no public exploit code or CISA KEV confirmation is available at time of analysis. Because the flaw yields code execution only within the sandbox, it must be chained with a separate sandbox escape to fully compromise the host.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the Chrome stable channel update (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) and confirm the version in chrome://version; enterprise fleets should force the update through their browser management policy and verify compliance. Until patching completes, reduce exposure by disabling or restricting the Actor feature via enterprise policy where available, and by restricting untrusted web navigation on high-value browsing profiles - both carry the trade-off of breaking legitimate functionality or user workflows. Because the defect grants only in-sandbox code execution, keep the Chrome sandbox enabled (do not launch with --no-sandbox) and prioritize OS-level and renderer sandbox hardening plus prompt patching of any chained privilege-escalation flaws, since disabling the sandbox would raise the impact to full host compromise. No public exploit code was identified at time of analysis, so no exploitation-driven emergency workaround is indicated beyond the version upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in Chrome's Actor subsystem, a memory-safety defect in which an object is released while a dangling reference remains, letting an attacker shape heap contents through crafted HTML and redirect execution. Chrome's multi-process architecture places this code in a renderer-side component, so any code execution obtained is confined by the sandbox boundary rather than reaching the OS directly. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered, low-complexity exploitation gated by user interaction, with high confidentiality and integrity impact scoped to the sandboxed context. Chromium rated the issue Medium severity in its own scheme, and the affected component is the Actor element tracked in Chromium issue 524319033.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim navigation (AV:N/UI:R), no auth (PR:N), easily triggered (AC:L); code runs in renderer with high C/I/A but sandbox confinement keeps scope unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity use-after-free in the Actor component that permits remote code execution inside the browser sandbox when a user navigates to attacker-controlled HTML. The flaw is unauthenticated but requires user interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis; full host compromise would require chaining with a separate sandbox escape. Leadership should care because Chrome is widely deployed across the workforce, and a single lured user could enable code execution within the browser, making fleet-wide patching the primary risk reduction.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB