EUVD-2026-105643
GHSA-fwpw-w29w-r9p6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Video component
-
ExecutionExecute arbitrary code in renderer process
-
ImpactGain code execution within Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML containing crafted video content in a vulnerable Chrome build prior to 156.0.8078.47 (UI:R - user must visit/render the page, so there is no fully passive or server-side trigger). No authentication or special Chrome configuration is required and it works against default installations, but the resulting code execution is CONTAINED within the renderer sandbox per the description, so a separate sandbox-escape vulnerability is needed to compromise the underlying host - this is the primary limiting factor on real-world severity. |
| Impact | Signals are moderately but not maximally aligned. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, which drives the 8.8 (High) base score. However, Chromium itself rated this 'Medium' severity, and the description explicitly scopes code execution to INSIDE the renderer sandbox (S:U, no scope change) - meaning this alone does not yield host compromise without a separate sandbox-escape chain, materially lowering real-world impact versus the 8.8 would suggest. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate patch-priority browser bug (ubiquitous product, plausible drive-by vector) but, absent a chained sandbox escape and absent any exploitation signal, not an emergency on its own. EPSS data is MISSING and should be checked before final prioritization. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or compromises/advertises into a legitimate one) containing crafted video content that triggers the memory-corruption flaw in Chrome's Video component when the victim's browser renders it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which an attacker would typically pair with a separate sandbox-escape bug to reach the host. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's video handling allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or render the attacker-controlled page - and no special configuration is needed on default installations. No public exploit code was identified at time of analysis, and because the resulting code execution is contained by the Chromium renderer sandbox, a separate sandbox-escape flaw would be required to compromise the underlying host, which is the main limiting factor on real-world severity despite the 8.8 CVSS base score.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, per the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; enterprise fleets should push the update through their normal channel and verify the reported browser version, and Chromium-based browsers should be updated once their upstream rebase includes this fix. Until patching is complete, the practical compensating controls are limited because the attack surface is normal web browsing: enforce strict site isolation and keep the Chromium renderer sandbox enabled (disabling it for compatibility would remove the primary containment boundary and is not advisable), restrict or gate access to untrusted web content and HTML attachments for high-value users, and consider disabling hardware-accelerated video decoding where policy allows, with the trade-off of reduced playback performance and higher CPU usage. Note that blocking media formats or ports is only partially effective since the trigger is a crafted HTML page rather than a distinct network service; monitoring for renderer crashes in the video path can provide detection signal in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper-restriction-of-operations-within-bounds-of-memory-buffer (memory corruption) defect in Chrome's video decoding/processing path, reachable through a crafted HTML page that supplies malicious media content to the browser. Chromium's media pipeline parses and decodes untrusted container and codec data, so a bounds or lifetime error in that component corrupts memory in the renderer process and can be steered into arbitrary code execution within that process. Google rates the issue Medium under its own Chromium severity scale (which accounts for sandbox containment), while the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 - the discrepancy reflects the fact that the impact is scope-unchanged and confined to the sandboxed renderer rather than the OS. The affected code ships in Chrome and other Chromium-based browsers that embed the same media stack, and the fix landed in the stable channel release 156.0.8078.47 tracked in the Chromium issue tracker (issues.chromium.org/issues/559707641).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges but requires the victim to open it (UI:R); code stays in the sandbox so scope is unchanged (S:U), with high renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a memory-corruption flaw in the browser's video processing path that can be triggered simply by a user visiting a crafted web page. Because Chrome is deployed broadly across the workforce and the flaw requires no credentials or special configuration, any employee browsing the web on an unpatched device represents a potential entry point, although the built-in renderer sandbox limits the immediate blast radius to the browser process rather than the underlying workstation. Leadership should treat this as a fleet-wide browser hygiene issue where rapid, verifiable version enforcement is the primary risk reducer.
Apply vendor patch. Where the update to 156.0.8078.47 cannot be deployed immediately, restrict browsing to managed profiles with enforced safe-browsing and script-blocking extensions, isolate high-risk web activity through remote browser isolation or a hardened virtual desktop, and apply network-level blocking of untrusted categories until version conformance is verified.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB