EUVD-2026-105655
GHSA-7ww4-mf57-h9fg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Google Lens
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to actively render a crafted HTML page in Chrome's Google Lens code path (UI:R - user interaction via visiting attacker-controlled content); no authentication or special privileges are needed (PR:N). The key limiting factor is that resulting code execution is confined to the Chrome sandbox (per the description and S:U), so full host compromise would require chaining an additional sandbox-escape vulnerability. Affected configurations are Chrome desktop versions prior to 156.0.8078.47; updating to 156.0.8078.47 or later remediates the issue. |
| Impact | This is a genuine high-priority browser flaw but with important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates remote, low-complexity, unauthenticated exploitation requiring only that a victim visit a crafted page - the classic drive-by profile. However, the description explicitly states code execution occurs 'inside the sandbox,' which materially constrains real-world impact: the attacker gains code execution in the renderer/Lens process but would need a separate sandbox-escape bug to compromise the host, so the S:U (scope unchanged) is consistent and the 8.8 reflects worst-case in-sandbox impact rather than full system takeover. Google/Chromium rated the security severity only 'Medium,' which conflicts with the 8.8 CVSS 'High' - this gap is expected for sandboxed UAF bugs and signals the practical risk is lower than the raw score implies. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC framing: exploitation=none observed, automatable=no (requires user to visit a page), technical impact=total within the sandbox boundary. Net: patch promptly given Chrome's reach and the ease of the delivery vector, but this is not a confirmed in-the-wild emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing content that triggers the Google Lens use-after-free when rendered, then lures a victim to visit it (phishing link, malvertising, or compromised site). When the page loads, the freed object is reused and the attacker achieves arbitrary code execution within the Chrome sandbox. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in the Google Lens component of Google Chrome versions prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires user interaction (the victim must visit or render attacker-controlled content), and the resulting code execution is confined by Chrome's sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code was identified at the time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later; the vendor has released a patch and the Chrome stable-channel advisory documents the fix (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). After updating, verify the browser build in chrome://version and enforce automatic updates where possible. If immediate updating is not feasible, reduce exposure by restricting users to trusted sites and, where enterprise policy permits, disabling or limiting Google Lens functionality-accepting the trade-off of reduced image-search and Lens features. Because the vulnerability requires rendering a crafted HTML page, standard phishing-resistant browsing controls and prompt patch deployment are the most effective mitigations; blocking arbitrary web content is not generally practical. Track the Chromium issue (https://issues.chromium.org/issues/561921279) for any further vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Google Lens handling, meaning the component can continue to reference memory after it has been freed, leading to memory corruption that may be shaped into code execution. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network reachability, low attack complexity, no privileges required, and mandatory user interaction; scope is unchanged, so impact is measured within Chrome's security context. The Google Lens code path is reachable from crafted HTML, making the browser renderer the entry point; however, the sandbox limits the blast radius. Memory corruption from the use-after-free can also cause browser crashes, consistent with the supplied denial-of-service tag. The Chromium issue and Chrome stable-channel advisory provide the authoritative technical tracking.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges gives AV:N/AC:L/PR:N; requires visiting the page (UI:R); in-sandbox arbitrary code execution keeps S:U with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome endpoints are exposed to a high-severity code-execution flaw in the Lens component that can be triggered when an employee views crafted web content, potentially allowing attacker code to run within the browser sandbox. The business risk is concentrated in workforce browsing and web-facing operations, with host-level compromise requiring an additional sandbox-escape chain; no public exploit was identified at time of analysis and a vendor fix is available. Leadership should prioritize rapid browser fleet remediation because Chrome is broadly deployed and user interaction is the only prerequisite described.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB