EUVD-2026-105637
GHSA-x427-pj9m-q5jv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Frames
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to visit or load an attacker-controlled crafted HTML page in a vulnerable Chrome build (< 156.0.8078.47) - consistent with UI:R in the CVSS vector; no authentication is needed (PR:N). The decisive limiting factor is that successful exploitation yields code execution only INSIDE the renderer sandbox per the Chromium advisory, so it does not alone compromise the host OS and would need to be chained with a separate sandbox-escape vulnerability for full system control. User interaction (navigating to or rendering the malicious frame/page) is mandatory, and Chrome's automatic update mechanism rapidly reduces the exposed population once the fix ships. |
| Impact | Signals are moderately strong but not top-tier. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity, unauthenticated exploitation requiring user interaction, with high confidentiality/integrity/availability impact and no scope change. Crucially, Chromium rated this Medium severity (not High/Critical), and the description explicitly states code execution occurs 'inside the sandbox' - meaning the flaw yields renderer compromise but does NOT by itself escape Chrome's sandbox, so real-world impact is contained unless chained with a separate sandbox-escape bug. This tension (CVSS 8.8 vs. Chromium 'Medium') is the key conflict: the high CVSS reflects full CIA loss within the renderer process, while Chromium's rating reflects the sandbox barrier limiting practical damage. No EPSS score, KEV listing, SSVC decision data, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a genuine browser memory-corruption bug worth patching promptly given Chrome's ubiquity, but absent KEV/POC/EPSS signals and given the sandbox containment, it is not an emergency on the level of a sandbox-escaping zero-day - prioritize via normal Chrome auto-update cadence. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into a compromised ad/iframe) that triggers a use-after-free in Chrome's Frames handling when a victim visits it. The dangling pointer is reclaimed with attacker-controlled data to achieve arbitrary code execution within the renderer sandbox; no public exploit was provided in the input, and meaningful system compromise would require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote code execution inside Chrome's renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 through a use-after-free in the Frames component. An unauthenticated remote attacker can trigger the flaw by convincing a victim to load a crafted HTML page (UI:R). Successful exploitation is confined to the renderer sandbox and would require a separate sandbox escape for host compromise; no public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
Vendor-released patch: 156.0.8078.47. Update Google Chrome to 156.0.8078.47 or later through the stable channel; verify the installed version at chrome://settings/help and restart the browser to complete the update. Google's advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and Chromium issue 554008013 provide the vendor fix details. Where immediate patching is not possible, enforce Chrome auto-update via enterprise policy, temporarily restrict browsing to trusted sites, and treat the renderer sandbox as a defense-in-depth control rather than a substitute for the update; these measures reduce exposure but do not remove the underlying use-after-free, and restricting browsing has obvious productivity trade-offs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Frames implementation, a memory-safety bug class in which an object is freed but later dereferenced, allowing attacker-influenced memory reuse and potential code execution within the renderer process. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered malicious HTML requiring user interaction, with high confidentiality and integrity impact but unchanged scope; per the Chromium advisory the execution primitive is contained by the renderer sandbox, so full host compromise requires chaining with a sandbox-escape flaw. Affected builds are Chrome desktop releases before 156.0.8078.47; the Chromium issue tracker entry 554008013 and Google's stable-channel advisory provide the authoritative fix and credit information.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to load it (UI:R); renderer-only code execution gives high CIA within the sandboxed process with no scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 156.0.8078.47 contain a high-severity use-after-free in the Frames component that can allow code execution inside the browser's renderer sandbox. This creates broad exposure for employees who browse the web, but the flaw is contained to the renderer and no public exploit identified at time of analysis, so full host compromise would require a separate sandbox escape. Leadership should prioritize updating affected browsers promptly while recognizing the reduced likelihood of deeper system impact.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB