EUVD-2026-105635
GHSA-wpm2-r77f-mhp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted HTML/JS payload
-
ExploitTrigger DOM use-after-free
-
ExecutionReclaim freed object and hijack control
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled web content (UI:R) in Google Chrome versions prior to 156.0.8078.47 - there is no pre-authentication server-side trigger; the user must visit or render a crafted HTML page. The most significant LIMITING factor is the sandbox boundary explicitly stated in the description: code execution is achieved 'inside the sandbox,' so impact is confined to the renderer process and does not grant host-level control absent a separate sandbox-escape vulnerability. No special non-default browser configuration is required, and no authentication is needed, but the required user interaction and sandbox confinement meaningfully reduce real-world blast radius compared to a raw 8.8 score. |
| Impact | This is a legitimate but qualified priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 High: network-reachable, low complexity, no privileges, but requiring user interaction (visiting a malicious page). A critical mitigating factor stated in the description itself is that code execution is confined 'inside the sandbox' - Chromium's renderer sandbox contains the compromise, so this single bug does not by itself yield host takeover without a separate sandbox-escape chain. This is why Google rates the Chromium security severity as Medium even though NVD's CVSS computes 8.8 - treat that as a signal/severity tension to reconcile, not a contradiction: NVD scores the raw renderer RCE impact (C:H/I:H/A:H), while Google's Medium reflects the sandbox boundary. No EPSS score, KEV listing, or POC availability was provided in the input, so exploitation likelihood cannot be quantified; absence of these is not evidence of safety but means widespread active exploitation is not confirmed. Browser UAF-in-DOM bugs are historically attractive to exploit developers and are frequently chained, so patching promptly is warranted despite no confirmed in-the-wild use. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's DOM handling. A victim running a pre-156.0.8078.47 Chrome visits the page (via link, ad, or compromised site), the freed object is reclaimed and manipulated, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit was identified in the provided data, and successful exploitation requires the user to load the attacker-controlled content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's DOM allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction, and the impact is confined to the renderer sandbox unless chained with a separate sandbox-escape flaw; Google rates the issue as Chromium security severity Medium despite the 8.8 CVSS score. Vendor-released patch: 156.0.8078.47, and no public exploit was identified at time of analysis.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later through the stable channel and restart the browser so the update takes effect; the release advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. For managed fleets, enforce the patched version via enterprise update policy and verify the browser build after rollout. No vendor workaround is documented, so interim compensating controls are limited: restricting users from loading untrusted HTML content or disabling JavaScript would reduce exposure but breaks normal browsing and web application functionality, while relying on the renderer sandbox only limits, but does not eliminate, the impact of successful exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's DOM implementation, meaning a DOM object can be freed while still referenced, allowing an attacker to reclaim the freed memory and redirect execution within the renderer process. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-delivered attack with no privileges required, but the victim must render attacker-controlled HTML. Because the described code execution occurs 'inside the sandbox,' the primitive is renderer-confined and does not by itself provide host-level compromise; escaping the sandbox would require a separate vulnerability. Affected versions are Chrome releases prior to 156.0.8078.47, as reflected by the EUVD version data and the Chrome stable-channel advisory; no CPE strings were supplied in the input.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page with no privileges but required user interaction (UI:R); renderer code execution yields high C/I/A, scope unchanged as impact stays within the sandboxed process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 are affected by a high-severity DOM use-after-free flaw that can allow remote code execution inside the browser sandbox when a user loads a crafted HTML page, creating potential exposure for workforce browsing, credentials, and browser-accessible data. The operational risk is broad because Chrome is widely deployed, but exploitation requires user interaction and remains confined to the renderer sandbox unless chained with a separate sandbox-escape issue; no public exploit identified at time of analysis. Leadership should prioritize rapid fleet patching to 156.0.8078.47 and verify compliance for high-exposure users.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB