EUVD-2026-105611
GHSA-cx67-5vg2-646p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious Worker JavaScript
-
ExploitTrigger use-after-free in Workers
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use the Web Workers feature path in Chrome and to navigate to attacker-controlled HTML/JavaScript (UI:R) - a drive-by web visit, malvertising, or compromised site suffices; no authentication or prior access is needed (PR:N). Key limiting factors: (1) user interaction is mandatory - the victim must load the crafted page; (2) the resulting code execution is confined to the renderer sandbox (S:U), so a separate sandbox-escape chain is required to reach the host OS; (3) only Chrome builds before 156.0.8078.47 are affected, so patched or auto-updated installations are not exploitable. |
| Impact | This is a genuine patch-worthy issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (visiting a crafted HTML page). Notably, there is a signal conflict: Google's Chromium program rated this 'Medium' severity, while the NVD-style CVSS base score is 8.8 (High) - this divergence is explained by the description stating code execution occurs INSIDE the sandbox (S:U, no scope change), meaning a second sandbox-escape bug would be needed for full host compromise, which tempers real-world impact. No EPSS score, SSVC decision, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. Status: no public exploit identified at time of analysis. The combination of enormous install base (Chrome) and a memory-corruption RCE primitive makes this attractive to attackers over time, but absent KEV/POC signals it should be treated as routine browser-patch hygiene rather than a drop-everything incident. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing JavaScript that abuses a Web Worker to trigger the use-after-free in Chrome. A victim running a version prior to 156.0.8078.47 visits the page (UI:R) and the freed object is reclaimed with attacker-controlled data, yielding arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Workers implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the browser's renderer sandbox if the victim loads a crafted HTML page. Only Chrome builds prior to 156.0.8078.47 are affected; exploitation requires user interaction (UI:R) and remains confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 as the fix.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later, then confirm the installed version via chrome://settings/help and relaunch the browser so the update takes effect. The vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and Chromium issue 553144392 provide the patch details. If immediate patching is not possible, reduce exposure by restricting unpatched Chrome to an allowlist of trusted sites or by using a separate, updated browser for general web access; disabling JavaScript would block the Workers path but causes major application breakage. Because exploitation requires a crafted page and remains inside the renderer sandbox, enforced auto-update and prompt patching are the primary controls, and the CVSS 8.8 memory-corruption rating warrants priority treatment even though no public exploit was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Workers subsystem, the browser API that runs JavaScript in background threads. A use-after-free occurs when an object is freed while a stale reference remains, and crafted HTML/JavaScript can groom memory to reuse the freed object, potentially redirecting execution within the renderer process. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-delivered attack with low complexity, no privileges required, mandatory user interaction, and unchanged scope, meaning code execution is limited to the Chrome renderer sandbox rather than the host operating system. EUVD lists Chrome builds below 156.0.8078.47 as affected; no CPE strings were supplied, and Chromium issue 553144392 is the primary technical reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remotely reachable via a crafted web page with no auth (AV:N/PR:N) but needing a victim visit (UI:R); in-sandbox RCE gives high C/I/A with no scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 expose users to a high-severity remote code execution risk that could allow a crafted webpage to run code inside the browser's renderer sandbox when a user interacts with it. Because Chrome is broadly deployed across the organization, leadership should prioritize rapid fleet remediation to reduce exposure, while noting that compromising the underlying host would still require a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB