EUVD-2026-105607
GHSA-x392-8g43-7m86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious GPU-triggering content
-
ExploitTrigger use-after-free in GPU process
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to load an attacker-controlled crafted HTML page that drives the vulnerable GPU code path (UI:R - user interaction via navigation). No authentication is required (PR:N) and default configurations are affected. The key LIMITING factor is that successful exploitation yields code execution only INSIDE the renderer/GPU sandbox (scope Unchanged); converting this into host compromise requires chaining a separate sandbox-escape vulnerability. User interaction (visiting the page) is also required, so it cannot be triggered fully passively against an idle browser. |
| Impact | Signals are mostly consistent but one critical nuance tempers the headline score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated bug requiring only that a victim load a web page - a classic drive-by profile. However, the description explicitly states code execution occurs 'inside the sandbox,' and the scope is Unchanged (S:U), meaning this flaw alone does NOT escape Chrome's renderer/GPU sandbox; real-world full-host compromise would require chaining it with a separate sandbox-escape. Notably, Chromium rated this only 'Medium' severity, which conflicts with the 8.8 'High' CVSS - the Chromium rating reflects the sandbox containment, so the 8.8 likely overstates standalone impact. No EPSS score was provided, there is no CISA KEV listing, and no public exploit is referenced, so there is no evidence of active exploitation or available POC. Net: patch promptly as part of normal Chrome update hygiene given the ubiquity of the product, but this is not a standalone drop-everything emergency absent an escape chain or in-the-wild activity. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious content that triggers the use-after-free in Chrome's GPU component when rendered. A victim simply visiting the page (UI:R) causes the freed GPU memory to be reused, letting the attacker execute arbitrary code within the renderer/GPU sandbox. No public exploit is identified at time of analysis, and the attacker would still need a separate sandbox-escape to affect the host OS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's GPU component allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page; all Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires only that a user navigate to attacker-controlled content (no authentication, default configurations exposed). Successful exploitation yields high confidentiality and integrity impact but remains scope-unchanged - code executes inside the renderer/GPU sandbox, so host compromise requires chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium severity as Medium even though the CVSS base score computes to 8.8. A vendor-released patch in Chrome 156.0.8078.47 is available.
RemediationAI
Vendor-released patch: upgrade to Google Chrome 156.0.8078.47 or later, delivered through the built-in auto-updater or your platform package manager (Windows/macOS: Help > About Google Chrome to force the update and then fully restart the browser so the new GPU process binary is loaded; Linux: update the google-chrome-stable or chromium package and restart all browser sessions). Confirm the version at chrome://version after restarting, and track the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. If immediate fleet-wide updating is not feasible, compensating controls are limited but actionable: disabling hardware acceleration via chrome://settings > System (or the HardwareAccelerationModeEnabled=false enterprise policy) removes the primary GPU code path and reduces exposure, at the cost of degraded rendering performance and possible breakage of WebGL/GPU-dependent web applications; restricting user navigation to trusted sites via URL allowlisting or enterprise content filters lowers the chance an attacker page is reached but is disruptive to general browsing. Do not treat either workaround as a substitute for the patch, and note that because the impact is sandbox-scoped, keeping the renderer/GPU sandbox enabled (do not use --no-sandbox or disabled-site-isolation flags) remains essential to preventing escalation beyond the browser.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) in Chrome's GPU process, the broker/renderer-adjacent component that handles hardware-accelerated rasterization, compositing, and graphics API calls (WebGL/Canvas/ANGLE) routed from renderer processes. Chromium's architecture isolates GPU work in its own sandboxed process; a crafted HTML page drives the vulnerable GPU code path into referencing a graphics resource after it has been freed, giving the attacker heap-shaping primitives that can be converted into arbitrary code execution within that sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms network-delivered, low-complexity exploitation with a required user navigation step, and S:U reflects the assessment's key nuance: the compromise is contained within the sandbox boundary, so the practical impact is sandboxed code execution rather than direct host takeover unless combined with an independent escape. No CPE strings were supplied in the feed data, so affected-version scoping relies on the vendor advisory and EUVD range data. Chromium security severity is rated Medium, which sits below the 8.8 CVSS base score and suggests the vendor considers the sandbox containment a meaningful mitigating factor.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N/UI:R; code execution stays within the sandbox so S:U, with full C/I/A impact to the sandboxed process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome installations older than 156.0.8078.47 carry a high-severity flaw that could allow an attacker to run code inside the browser sandbox when a user opens crafted web content. No public exploit or confirmed active exploitation was identified at time of analysis, and the issue is constrained by the browser sandbox, but the large Chrome footprint means unpatched devices create meaningful exposure to browser-session confidentiality and integrity risks. A vendor-released patch in Chrome 156.0.8078.47 is available, so leadership should treat remediation as an urgent patch-management action.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB