EUVD-2026-105666
GHSA-rgqp-j42f-fq68
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Chromoting component
-
ImpactExecute arbitrary code within browser sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome (prior to 156.0.8078.47) to load an attacker-controlled crafted HTML page that exercises the Chromoting (Chrome Remote Desktop) code path (UI:R - user interaction via visiting the page is mandatory). The key limiting factor is sandbox containment: the description states code runs 'inside the sandbox,' so without a chained sandbox-escape the attacker does not gain host-level code execution. Additional limiters are the required user interaction and that Chrome's silent auto-update rapidly reduces the exposed population once the fix ships. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw needing only user interaction, which on paper reads as high priority. However, this score materially conflicts with the two most important signals: the Chromium team's own 'Medium' severity rating and the description's explicit statement that code execution occurs 'inside the sandbox.' Sandboxed code execution is a containment boundary - without a separately chained sandbox-escape, real-world impact on the host is far lower than C:H/I:H/A:H implies, so the 8.8 overstates true risk. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no POC is referenced: exploitation status is 'no public exploit identified at time of analysis.' Net assessment: this is a genuine browser memory-corruption bug that should be patched via normal Chrome auto-update cycles, but it is not an emergency - it is a high-CVSS-but-moderate-real-risk issue, consistent with the vendor's Medium rating rather than the 8.8 base score. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption bug in Chrome's Chromoting (Chrome Remote Desktop) component when a victim visits it. Successful exploitation yields arbitrary code execution confined within the browser sandbox, which would then need to be chained with a separate sandbox-escape to compromise the host. No public exploit code is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Chromoting (Chrome Remote Desktop) component before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute code inside Chrome's sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction, and the assessed impact is limited to low confidentiality, integrity, and availability because code execution is contained by the browser sandbox unless chained with a separate sandbox escape. No public exploit identified at time of analysis, no CISA KEV active exploitation is indicated in the supplied data, and Google has released a fixed build.
RemediationAI
Vendor-released patch: update Google Chrome to 156.0.8078.47 or later using Chrome's built-in update mechanism or enterprise software deployment, then restart the browser so the new binary is active; the stable-channel advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. If immediate fleet-wide upgrade is not possible, disable or remove the Chrome Remote Desktop/Chromoting extension or app for users who do not need remote support and block its installation through enterprise policy; this reduces exposure to this code path but breaks remote-desktop workflows and does not fix the underlying browser memory-safety issue. Keep Chrome's sandbox enabled and prioritize upgrading users who routinely browse untrusted content, since the attack requires only a crafted HTML page and user interaction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chromoting is Google Chrome's component for Chrome Remote Desktop, handling remote-session negotiation and related data handling within the browser. CVE-2026-113258 is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, so the root cause is a memory-safety defect in how Chromoting processes attacker-influenced input. The attack vector is a crafted HTML page loaded in Chrome that reaches the vulnerable Chromoting code path; because the resulting corruption occurs inside the sandboxed Chrome process, arbitrary code execution is initially confined to the sandbox. That containment is why the independent assessment reduces impact to low confidentiality, integrity, and availability relative to the input vector's high-impact assumption; host-level compromise would require an additional sandbox-escape primitive. No CPE strings were supplied, so platform-specific mapping could not be confirmed from the input.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page with no auth but mandatory user interaction (UI:R); impact lowered to C/I/A:L because code execution is confined to the sandbox with no escape, matching the vendor's Medium rating.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's Chromoting (Chrome Remote Desktop) component contains a high-severity memory-corruption flaw that could allow a remote attacker to execute code inside Chrome's sandbox when a user opens a crafted HTML page. The immediate business risk is moderated by required user interaction, sandbox containment, and no public exploit identified at time of analysis, but broad Chrome deployment means unpatched users remain exposed. Leadership should prioritize updating Chrome to the vendor-fixed build 156.0.8078.47 or later and verify coverage across managed endpoints.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB