EUVD-2026-105620
GHSA-3p66-798j-3c23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryServe crafted HTML/CSS payload
-
ExploitTrigger CSS memory corruption (CWE-119)
-
ExecutionEscape Chrome renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using an affected Chrome desktop or ChromeOS build (prior to 156.0.8078.47) to load an attacker-controlled HTML page whose CSS triggers the memory-corruption condition in the CSS engine; this maps to the CVSS UI:R requirement. The single limiting factor is this user interaction - the victim must navigate to or render the malicious page (e.g., via a link, ad, iframe, or watering-hole site). No authentication, no special Chrome configuration, and no non-default feature are required: the CSS rendering path is exercised by default when any page is displayed. The practical constraint is simply getting the target to open the crafted content, after which exploitation is unauthenticated and low-complexity. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page, with a scope change reflecting sandbox escape and full confidentiality/integrity/availability impact. Google/Chromium rates the security severity Critical and the description explicitly states code execution OUTSIDE the sandbox, which is the most dangerous class of Chrome bug. Mitigating signals: no EPSS score was provided, CISA KEV status is not indicated (KEV=NO in available data), and no public proof-of-concept is referenced, so there is currently no public evidence of active exploitation or weaponization. The required user interaction (UI:R) modestly lowers real-world risk versus a fully drive-by zero-click flaw, but given Chrome's install base and the trivial 'visit a page' interaction, this should be patched urgently. Note the absence of EPSS/KEV/POC is a data gap, not evidence of safety - these absences cannot be used to downgrade priority for a Critical sandbox-escape in a browser. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious CSS that triggers the memory-corruption bug in Chrome's CSS engine when rendered. A victim running an unpatched Chrome (prior to 156.0.8078.47) simply visits the page, and the flaw is exploited to execute arbitrary code outside the browser sandbox, giving the attacker control of the user's machine. No public exploit code is identified at time of analysis, but the low attack complexity and single-click delivery make this highly attractive for drive-by and watering-hole campaigns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's CSS engine allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page; affected builds are Chrome desktop and ChromeOS prior to 156.0.8078.47. Exploitation requires user interaction because the victim must render the malicious page, and no public exploit was identified at time of analysis. Google rates the issue Critical (CVSS 9.6) and has released a fixed version.
RemediationAI
Upgrade to Google Chrome 156.0.8078.47 or later (Vendor-released patch: 156.0.8078.47), and apply the corresponding ChromeOS stable-channel update referenced at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html; restart the browser after updating. If the update cannot be deployed immediately, reduce exposure by enforcing enterprise auto-update and browser-restart policies, restricting users to trusted sites through URL filtering or a proxy, and isolating untrusted browsing in a separate low-privilege environment or virtual machine-recognizing that these are partial mitigations because CSS rendering is on by default and no feature toggle removes the attack surface. The desktop advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is https://issues.chromium.org/issues/570638836.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer in the CSS implementation of Chromium's Blink rendering engine used by Google Chrome. A crafted HTML page supplies CSS that drives the style engine into an out-of-bounds memory condition; the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H indicates low-complexity remote triggering that requires the victim to render the page, with a scope change consistent with the vendor's statement that code execution may occur outside the sandbox. The CSS rendering path is exercised by default during normal page display, so no special Chrome configuration or non-default feature is needed; the primary precondition is convincing the target to open the attacker-controlled content. EUVD identifies Chrome builds below 156.0.8078.47 as affected; no CPE strings were included in the supplied data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no privileges gives AV:N/AC:L/PR:N; a victim must load the page (UI:R); sandbox escape crosses a security boundary (S:C) enabling full code execution (C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome desktop and ChromeOS deployments below version 156.0.8078.47 carry a critical security risk that could allow an attacker to compromise user endpoints through crafted web content and potentially escape the browser sandbox, exposing organizational data. Because Chrome is widely used for business workflows, leadership should treat this as a broad endpoint exposure requiring rapid patch verification; no public exploit was identified at time of analysis, and Google has released a fixed version.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB