EUVD-2026-105598
GHSA-5hx8-8vqr-6wqp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious media content
-
ExecutionTrigger memory corruption in Media component
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled HTML page that is processed by Chrome's Media component on Windows, running a version prior to 156.0.8078.47 - this user interaction (UI:R) is the primary limiting factor. Resulting code execution is confined to the renderer sandbox per the vendor description, so meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability. No authentication is needed (PR:N), but the bug is specific to the Media component and the Windows build. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity flaw requiring only that a victim open a crafted HTML page, with high impact to confidentiality, integrity and availability. However, two signals pull the real-world priority down: the description explicitly states code executes 'inside the sandbox,' and Chromium's own security team rated this Medium - not High/Critical - which is why the raw 8.8 overstates standalone impact. Code confined to the renderer sandbox is not full host compromise; a separate sandbox-escape would be needed to weaponize this into true arbitrary code execution on the machine. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or available exploit code. Net: a legitimate memory-corruption bug in a ubiquitously deployed browser that warrants prompt patching via normal Chrome update cadence, but - absent sandbox escape, POC, or KEV - it is not an emergency relative to the 8.8 number. Note the input Tags list 'Microsoft' as a vendor; this is a Google Chrome vulnerability and Microsoft is only relevant as the host OS (Windows), so that tag is misleading. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing specially crafted media content and lures a Windows Chrome user (prior to 156.0.8078.47) to visit it. When Chrome's Media component parses the malicious content, the memory corruption triggers and the attacker achieves code execution within the renderer sandbox. No public exploit code was identified at time of analysis, and full host compromise would additionally require a sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Media component on Windows allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. The CVSS 3.1 vector (8.8) reflects network reach, low complexity, no privileges, and required user interaction, with high confidentiality, integrity, and availability impact; code execution is sandbox-confined, so host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis and no CISA KEV entry is indicated in the supplied data, while Google has released a fixed Chrome build.
RemediationAI
Vendor-released patch: Chrome 156.0.8078.47. Update Google Chrome on Windows to version 156.0.8078.47 or later using the stable-channel update referenced at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, then restart the browser; enterprise administrators should enforce the minimum version through update policies. Because the vulnerability yields code execution inside the renderer sandbox, do not disable Chrome's sandbox (for example, with --no-sandbox) and keep it enabled, since doing so would remove the main containment boundary at the cost of reduced compatibility for unusual workflows. If immediate updating is not possible, limit exposure by restricting browsing to trusted sites and isolating high-risk web use in a separate hardened environment, accepting reduced usability and administrative overhead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 memory-buffer bounds violation in Chrome's Media handling on Windows. A crafted HTML page drives the Media component into corrupting memory, which the CVSS vector rates AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H-meaning an unauthenticated remote attacker needs only victim interaction to trigger it, and the resulting arbitrary code execution is contained by Chrome's renderer sandbox. The Windows-specific build and Media component scope are important: exploitation is not described as a sandbox escape, so it does not by itself yield host-level compromise; that would require chaining a separate vulnerability. Google rated the Chromium security severity Medium despite the 8.8 CVSS score.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); code execution yields high C/I/A within the unchanged renderer scope, consistent with the vendor vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on Windows prior to 156.0.8078.47 exposes users to a high-severity memory-corruption flaw that could let a remote, unauthenticated attacker execute code inside the browser sandbox after a user opens a crafted web page. Because the issue is remotely reachable and requires only user interaction, it creates risk for any workforce relying on unpatched Chrome, though sandbox confinement means full host compromise would require an additional exploit; no public exploit identified at time of analysis. Leadership should care because browser-based attacks can affect many users and disrupt productivity, but a vendor fix is available and should be prioritized.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB