EUVD-2026-105663
GHSA-rqhw-v93j-689q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryManipulate form objects via JavaScript
-
ExploitTrigger use-after-free in Forms
-
ExecutionReclaim freed memory with controlled data
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively load attacker-controlled content in Chrome - i.e., visit or be redirected to a crafted HTML page (CVSS UI:R, PR:N: unauthenticated but user interaction mandatory). The trigger is in the Forms component, so a page containing malicious form markup/JavaScript is needed. The primary LIMITING factor is that code execution is confined to the renderer sandbox per the description: a successful exploit does not by itself compromise the host OS or escape Chrome, and would need to be chained with a separate sandbox-escape bug for full system impact. Victims on Chrome 156.0.8078.47 or later, or with auto-update applied, are not affected. |
| Impact | This is a CWE-416 use-after-free in the Forms component of Google Chrome, with an input CVSS of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicating network-reachable, low-complexity, unauthenticated exploitation that requires user interaction (visiting a crafted HTML page). A critical mitigating signal, however, comes directly from the description: code execution is achieved ONLY 'inside the sandbox.' This means a single bug does not yield host compromise - Chrome's renderer sandbox contains the attacker, who would typically need to chain a separate sandbox-escape bug to affect the underlying OS. This is consistent with the vendor's own 'Chromium security severity: Medium' rating, which contrasts notably with the 8.8 'High' CVSS. No EPSS score, SSVC decision, KEV listing, or POC was provided; per the data, there is no public exploit identified at time of analysis and no confirmed active exploitation. Net assessment: this is a standard-urgency browser memory-corruption patch, not an emergency. The high CVSS overstates real-world severity because it does not model the sandbox boundary; the vendor Medium rating is the more realistic signal. Prioritize via routine browser auto-update rather than emergency out-of-band response, absent new exploitation intelligence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/JavaScript that manipulates form elements to trigger a use-after-free in Chrome's Forms code. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page and the dangling-pointer reuse gives the attacker arbitrary code execution within the renderer sandbox. No public exploit code was identified at time of analysis; full system compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in the Forms component of Google Chrome before 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution, but only inside the renderer sandbox, by convincing a victim to load a crafted HTML page containing malicious form markup or JavaScript. Exploitation requires user interaction (CVSS UI:R) and low complexity, and the CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact within the compromised renderer rather than on the host OS; escaping Chrome would require chaining a separate sandbox-escape flaw. Vendor patch 156.0.8078.47 is available, and no public exploit code or CISA KEV confirmation was identified at time of analysis. Note the reported Medium Chromium severity contrasts with the 8.8 NVD-style vector, which should guide prioritization toward prompt patching rather than emergency response.
RemediationAI
Upgrade Google Chrome to version 156.0.8078.47 or later - the vendor-released patch, documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html - and confirm the version via chrome://version, allowing auto-update to complete and relaunching the browser so the new binary is actually loaded. For managed fleets, push the fixed build through enterprise policy or your software deployment tooling and verify compliance; for Chromium derivatives, wait for or request a rebase onto 156.0.8078.47+. Where immediate patching is not possible, reduce exposure by restricting browsing to trusted sites through allowlist-based URL filtering, disabling or tightly scoping JavaScript on untrusted pages via enterprise policy (accepting that this breaks most modern web applications), and keeping site isolation enabled so a compromised renderer remains contained - noting that these are compensating controls that shrink the attack surface rather than remove the use-after-free, and that sandbox containment does not protect the user's data within the compromised tab. Monitor the Chromium issue 562230410 for any update indicating public exploit code, which would shorten the acceptable patch window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free: Chrome's Forms handling (form rendering, autofill-adjacent form structures, and their DOM/binding lifetimes) frees an object while a reference remains, so a crafted page can trigger access to reclaimed memory and, with heap grooming, redirect control flow within the renderer. The flaw lives in the Blink renderer, which is why the impact ceiling is arbitrary code execution inside the sandbox - memory corruption of this class is a standard precursor to renderer compromise and often a first stage in exploit chains that pair it with a sandbox escape. Per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector, the attack is network-delivered and unauthenticated, with the only barrier being that the victim must load attacker-controlled content; the scope is unchanged because containment is enforced by the sandbox. Affected CPE range is Chrome earlier than 156.0.8078.47 (EUVD records the fixed boundary as 156.0.8078.47), and the issue is tracked upstream as Chromium issue 562230410.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N), no auth (PR:N) but victim must load the page (UI:R); code runs in-sandbox so no scope change (S:U) with high renderer-context impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 156.0.8078.47 contain a use-after-free in the Forms component that can let a crafted web page execute code within the browser's renderer sandbox after user interaction. For the organization, unpatched Chrome users face potential compromise of browser-session data and disruption, but full host takeover would require an additional sandbox-escape flaw. Leadership should treat this as a prompt patching priority rather than an emergency, given the vendor fix and no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB