EUVD-2026-105633
GHSA-39vm-33p4-769v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers Shadow DOM memory corruption
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactAccess in-process browser/tab data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome desktop build prior to 156.0.8078.47 and to open attacker-controlled HTML that exercises the Shadow DOM code path (UI:R - user must visit/load the page); no authentication or special privileges are needed (PR:N). The key limiting factor is that resulting code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so real-world host compromise requires chaining a separate sandbox-escape vulnerability. No non-default configuration is required - standard Chrome HTML rendering is affected. |
| Impact | Signals are mixed but lean toward moderate real-world priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - the classic browser drive-by profile. However, the description explicitly states code execution occurs 'inside the sandbox' and the scope is Unchanged (S:U), meaning this is a renderer-contained memory-corruption bug with no demonstrated sandbox escape; absent a chained escape it does not by itself yield host compromise, which tempers the 8.8 figure. Chromium's own security severity rating is 'Medium,' notably lower than the CVSS 8.8, reflecting that sandbox containment limits impact - this discrepancy between the 8.8 CVSS and vendor 'Medium' rating should be treated as a genuine signal, not an error. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. Net: a patch-promptly browser bug rather than an emergency, but the unauthenticated-UI-only exploitation path means it should not be deprioritized for long, as Chrome renderer bugs are frequently chained with sandbox-escape bugs. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that abuses Shadow DOM handling to trigger memory corruption in Chrome's rendering engine. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) simply visits the page, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified at the time of analysis, and the attacker would still need a separate sandbox-escape bug to affect the underlying host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Shadow DOM implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.47. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact within the compromised renderer, but with unchanged scope and execution confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Chromium's own security severity rating is Medium, Google has shipped a fixed build, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: 156.0.8078.47 - upgrade Google Chrome to that build or later using the built-in updater (Help > About Chrome, or the enterprise MSI/PKG/DEB/RPM deployment channel) and confirm the reported version in chrome://version; organizations should verify fleet-wide compliance through their update-management or Chrome Browser Cloud Management console, since stale installs are the primary exposure. The vendor advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the engineering record at https://issues.chromium.org/issues/553390794. Because the bug is reachable through ordinary page rendering, there is no clean feature toggle that removes the attack surface without breaking normal browsing: disabling JavaScript or the web-components/Shadow DOM path would blunt the exploit but breaks a large class of legitimate sites and is not a realistic enterprise policy; blocking unpatched clients at the network edge via user-agent or version-based access rules is effective but locks out users until they update and generates support load. Site isolation and the renderer sandbox are already enabled by default and limit this bug to renderer-level code execution rather than host compromise, so they should not be treated as an alternative to patching - they only mean that exploitation must be chained with a separate sandbox escape. Prioritize patching for users who routinely browse untrusted or attacker-influenced content, where user interaction (UI:R) is effectively guaranteed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer, resident in Blink's Shadow DOM implementation, the web-components machinery Chrome uses to attach encapsulated shadow trees to DOM elements and to resolve style and event propagation across shadow boundaries. Rendering attacker-supplied HTML that exercises the vulnerable Shadow DOM code path can drive an out-of-bounds memory access in the renderer process, which modern Chrome builds harden with allocator partitioning (PartitionAlloc), pointer-integrity mitigations such as MiraclePtr, and site isolation, but which still yields a controllable primitive inside the renderer. Because the primitive is reached purely through page rendering with no credentials or non-default configuration, exploitation is gated only by user interaction (UI:R) - the victim must navigate to or load the crafted page. Critically, the resulting code execution is scoped to the sandboxed renderer (S:U, unchanged scope), so turning it into host-level compromise requires a second, independent sandbox-escape vulnerability; this containment is the main reason the vendor rates the issue Medium while the raw memory-corruption CVSS lands at 8.8. Tracking identifiers are EUVD-2026-105633 and Chromium issue 553390794, with the fix landing in the Chrome stable channel update dated October 2026.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); scope unchanged as execution is sandbox-contained, with high impact to renderer-held data.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a high-severity memory-corruption flaw in the Shadow DOM implementation that could allow an attacker to run code inside the browser's renderer sandbox if a user visits a crafted page. Because execution is confined to the renderer and no public exploit or active exploitation has been identified, the immediate enterprise risk is concentrated in workforce browsing rather than direct host takeover.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB