EUVD-2026-105612
GHSA-6m7j-6fx5-3cm8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers OptimizationGuide memory corruption
-
ExecutionOverflow corrupts renderer memory
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 156.0.8078.47 and to visit or render an attacker-crafted HTML page (CVSS UI:R), so it is not fully automatable drive-by without user navigation. No authentication is required (PR:N) and the default browser configuration is sufficient - no special feature toggle is named in the description. The key limiting factor is that resulting code execution is explicitly confined to the browser sandbox (Scope:Unchanged); full host compromise would additionally require chaining a separate sandbox-escape vulnerability. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, unauthenticated flaw requiring only that a victim load a crafted HTML page, with high impact to confidentiality, integrity, and availability. However, the description qualifies the outcome as 'execute arbitrary code inside the sandbox,' and Google rated the Chromium security severity only Medium - signals that conflict with the 8.8 High score: code execution is confined to the renderer sandbox (Scope:Unchanged) and would require a separate sandbox-escape to achieve full host compromise, so real-world impact is lower than the raw 8.8 suggests. No EPSS score, KEV listing, or POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability cannot be quantified from the inputs. Net: a patched, browser-class memory-corruption bug on an ubiquitous product - worth prompt patching in managed fleets - but not a confirmed in-the-wild priority, and the UI:R requirement plus sandbox confinement meaningfully reduce practical risk versus the headline score. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption bug in Chrome's OptimizationGuide component when a victim visits it. Because the vector is network with required user interaction (UI:R), the victim must browse to the attacker-controlled page; successful exploitation yields code execution confined to the browser sandbox. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the OptimizationGuide component of Google Chrome versions prior to 156.0.8078.47 lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page potentially achieve arbitrary code execution - but only within the browser's sandbox. Chrome-side exploitation requires user navigation (UI:R), so it is not a fully automatic drive-by, and escaping to the host OS would need a separate sandbox-escape chain; the CVSS 3.1 vector scores 8.8 because of high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later - the vendor-released patch - and verify the version via chrome://settings/help or the About Chrome menu, restarting the browser so the update takes effect; enterprise fleets should push the fixed build through their normal update mechanism (Chrome Enterprise policies, managed software distribution) and confirm compliance across all endpoints. The advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the underlying bug at https://issues.chromium.org/issues/553146807. Until patched, compensating controls carry trade-offs: disabling or restricting the OptimizationGuide-related components is not a documented, guaranteed mitigation and may degrade page-loading performance, and blocking untrusted HTML is impractical for general browsing. More reliable interim measures are to reduce exposure by enforcing site isolation (already default, but verify chrome://process-internals), restricting high-risk browsing through enterprise URL filtering or a remote-browser-isolation service, and limiting the value of sandbox-confined code execution by keeping the OS and other applications patched so a chained sandbox escape is harder to obtain. Because exploitation requires the victim to load a crafted page, user awareness and mail/web gateway filtering against suspicious links provide limited but real friction; these controls should be treated as temporary until the browser is updated to 156.0.8078.47.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer in Chrome's OptimizationGuide, the component that supplies the browser with server-provided optimization hints (such as loading and rendering predictions) and therefore routinely parses remote or attacker-influenced content. Per the Chromium severity rating this is a Medium-severity memory-corruption bug, but under the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) it is scored 8.8: network-reachable, no privileges required, and only user interaction (rendering a crafted HTML page) as a prerequisite. Because Scope is Unchanged, the assessed impact is code execution confined to the renderer/Chrome sandbox - the same-origin and site-isolation boundaries remain in place - so meaningful host compromise would depend on chaining an additional sandbox-escape vulnerability. Affected builds are Chrome versions earlier than 156.0.8078.47 (EUVD lists the fixed release as 156.0.8078.47), with CPE-style product identification pointing to Google Chrome on desktop platforms; the root cause class (buffer bounds violation) is consistent with the described memory corruption and potential arbitrary code execution inside the sandbox.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but required user navigation (UI:R); sandboxed RCE keeps Scope:Unchanged while renderer-context C/I/A impact is high.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome deployments prior to 156.0.8078.47 carry a high-severity memory-corruption flaw in the OptimizationGuide component that could allow a crafted webpage to compromise the browser process and expose session data or user activity. Risk is concentrated on endpoints where users browse untrusted web content; exploitation requires user navigation and remains contained by Chrome's sandbox unless combined with a separate escape, and no public exploit identified at time of analysis. Vendor-released patch: 156.0.8078.47 is available, so leadership should prioritize verified fleet-wide browser remediation to reduce broad endpoint exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB