EUVD-2026-105640
GHSA-pwx2-vr7v-jq78
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Navigation
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-controlled HTML page in Chrome before version 156.0.8078.47 (UI:R), triggering the use-after-free in the Navigation component. No authentication or special configuration is needed and default configurations are affected, but the limiting factors are significant: user interaction is mandatory (the victim must visit the malicious page), and code execution is contained within the renderer sandbox - a separate sandbox-escape flaw would be required to compromise the underlying host. Modern Chrome auto-update further narrows the exposure window. |
| Impact | Signals are moderately consistent but point to lower real-world urgency than the raw 8.8 score suggests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network, low-complexity, unauthenticated attack requiring user interaction - the classic 'victim visits a malicious page' browser pattern. However, the description explicitly scopes code execution to 'inside the sandbox,' and Chromium itself rated the security severity only Medium; the 8.8 reflects renderer-process impact (C:H/I:H/A:H) without crediting Chrome's multi-process sandbox as a mitigating barrier, so a sandbox escape chain would be needed for full host compromise - a material gap between the headline score and practical impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or an available exploit; exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. Net: this is a standard Chrome renderer UAF - worth prompt patching given Chrome's ubiquity, but not a confirmed emergency absent KEV/EPSS/POC signals. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a victim to visit it (via phishing link, malvertising, or compromised site). The page triggers a use-after-free in Chrome's Navigation component, achieving arbitrary code execution confined to the renderer sandbox. No public proof-of-concept was identified, and full host compromise would require an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Navigation component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), since the target must actively visit the attacker-controlled page, and the resulting code execution is confined to the renderer sandbox - escaping to the host would require an additional sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has released a fixed build (156.0.8078.47), so real-world urgency is lower than the raw 8.8 base score implies.
RemediationAI
Vendor-released patch: Chrome 156.0.8078.47. Update through Chrome's built-in updater (Settings > About Chrome, then Relaunch) and confirm the reported version is 156.0.8078.47 or later, since the update is only effective after the browser restarts. For managed fleets, force the update through enterprise policy - set the Chrome auto-update policy via your OS management channel, pin the target version, and use the RelaunchNotification policies to nudge users to restart rather than relying on voluntary action; note that forced relaunches can interrupt active sessions, so schedule them in maintenance windows. Verify patched status across the fleet with the browser version inventory and treat any endpoint still below 156.0.8078.47 as exposed. There is no configuration toggle that eliminates this use-after-free, but keeping Site Isolation enabled (default in current Chrome) helps contain renderer compromise to the sandbox, and enforcing the default renderer sandbox - rather than disabling it for compatibility testing - preserves the primary barrier between exploit code and the host. Reference advisories: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://issues.chromium.org/issues/556899544. Organizations unable to update immediately should restrict browsing of untrusted web content to patched hosts or isolated remote-browsing infrastructure, accepting the usability trade-off of that restriction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-416 use-after-free, a memory-corruption class in which an object is freed while a dangling reference to it remains reachable; subsequent use of that pointer allows an attacker to manipulate heap memory, corrupt vtables or adjacent allocations, and ultimately redirect execution flow. Here the defect sits in Chrome's Navigation subsystem - the browser-side logic that drives frame and document transitions (initiating navigations, committing them, and tearing down the old document) - which is a common locus for lifetime bugs because navigation is asynchronous and racing between the renderer and browser process. The affected technology is Chromium/Blink running on desktop Chrome builds earlier than 156.0.8078.47. Because the primitive is reached through a rendered HTML page, the attacker's JavaScript can shape heap layout to make the dangling allocation reusable, but the exploit payload lands in the renderer process, which Chrome isolates in a restricted sandbox; achieving host compromise therefore requires chaining a second, independent sandbox-escape bug. Google rated the issue Chromium security severity Medium, and the CVE was assigned a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth but mandatory user interaction (UI:R); code runs in-renderer so scope stays Unchanged, matching the vendor's base metrics.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a high-severity use-after-free in the Navigation component that can allow arbitrary code execution within the renderer sandbox when a user visits a crafted HTML page. The exposure is broad because Chrome is widely deployed, but the attack requires user interaction and code execution remains confined to the renderer sandbox; no public exploit or active exploitation has been identified, and Google has released a fixed build. Leadership should prioritize fleet-wide patching to reduce risk without treating this as an emergency incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB