EUVD-2026-105668
GHSA-c5m5-9w4f-fjp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malformed input to vulnerable API
-
ExecutionTrigger improper input validation (CWE-20)
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-controlled crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47) - this user-interaction requirement (UI:R) is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and it works against default Chrome configurations with no special settings. The decisive containment limiter is that resulting code execution is confined to the renderer sandbox (scope unchanged, S:U); meaningful host-level impact additionally requires chaining a separate sandbox-escape vulnerability, which is not part of this CVE. |
| Impact | Signals are moderately consistent but point to a lower real-world priority than the 8.8 CVSS base score implies. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must open a crafted HTML page). Critically, the description scopes code execution to 'inside the sandbox' and the vector keeps S:U (no scope change), so this is NOT a full renderer-escape/host-compromise bug on its own - Chrome's multi-process sandbox is the containment boundary, and absent a chained sandbox-escape the attacker gains execution only within the restricted renderer context. This tension (C:H/I:H/A:H raw impact vs. sandbox containment) is why Google's own Chromium severity rating is 'Medium' rather than High/Critical. No EPSS score, KEV listing, or POC was supplied; exploitation status is therefore 'no public exploit identified at time of analysis.' Net: patch promptly via normal Chrome update cadence, but this is not an emergency unless paired with a separate sandbox escape. CONFLICT TO NOTE: raw CVSS 8.8 (High) contradicts the vendor's Medium rating - the discrepancy is explained by sandbox containment that the base CVSS impact metrics do not capture. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page (e.g., via a malicious site, compromised ad, or iframe) and lures a victim running a vulnerable Chrome build to visit it. The malformed input reaches the affected API, triggering improper input validation (CWE-20) and allowing arbitrary code execution confined to the renderer sandbox. No public exploit code was identified at time of analysis, and full host compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Google Chrome builds prior to 156.0.8078.47 carry an input-validation flaw in an exposed API that allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox when a victim simply loads a crafted HTML page. Exploitation hinges entirely on the user-interaction requirement (UI:R): the victim must open attacker-controlled HTML in a vulnerable, default-configured Chrome, and the resulting code execution stays inside the browser's renderer sandbox (S:U), so host-level compromise would additionally require chaining an unrelated sandbox-escape bug that is not part of this CVE. Although the base score reaches 8.8, no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and Chromium's own rating for the issue is only Medium, so real-world priority sits below what the numeric score suggests. Vendor-released patch: 156.0.8078.47.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - this is a vendor-released patch, so the primary action is simply confirming the build via chrome://settings/help (or an enterprise version check) and allowing the built-in updater to complete, then relaunching all browser processes. Refer to the Stable Channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) and Chromium issue 562237871 for release details. Chromium-based derivatives should be checked for equivalent updates. Because impact is confined to the renderer sandbox, preserving Chrome's sandbox and Site Isolation is a meaningful compensating control - do not run with --no-sandbox and do not disable Site Isolation, since doing so converts a contained bug into potential host compromise; the trade-off is possible application incompatibility, which should be validated before fleet-wide changes. Where patching lags, enterprise policies can narrow exposure by blocking untrusted or uncategorized sites via URL blocklists and Safe Browsing enhanced protection, and by enforcing extension allowlists; the trade-off is reduced user flexibility and some false positives. Disabling JavaScript globally would blunt the attack surface but breaks most of the modern web and is not practical outside kiosk scenarios. Detecting exploitation is difficult since the trigger is a normal page load, so rely on sandbox-bypass-aware endpoint monitoring rather than HTML filtering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness class is CWE-20 (Improper Input Validation): a Chrome API surface fails to sufficiently validate attacker-influenced input, and because that input is reachable from ordinary web content rendered in the sandboxed renderer, a crafted HTML page can drive the API into an unsafe state that ultimately permits arbitrary code execution within the sandbox. The reporting credit goes to chrome-cve-admin@google.com, with tracking in Chromium issue 562237871 (restricted-access bug tracker) and the corresponding Stable Channel update advisory. Note the divergence in scoring: Google/Chromium assigns this a security severity of Medium, while the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 - the gap is explained by the vector, which models full confidentiality/integrity/availability impact without accounting for sandbox containment or for the fact that exploitation is gated on convincing a user to load the crafted page. No CPE strings were supplied in the source data; the authoritative affected-range statement available is from ENISA EUVD, which identifies Chrome builds below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim interaction (UI:R) with no auth (PR:N); execution stays in-sandbox so S:U, but in-context C/I/A are high, matching the vendor vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome installations below version 156.0.8078.47 face a high-severity code-execution risk that is triggered when a user opens a specially crafted HTML page, potentially affecting any workforce member who browses the web with an unpatched browser. The flaw is contained within Chrome's renderer sandbox, so full endpoint compromise would require an additional unrelated exploit; no public exploit identified at time of analysis, and the vendor has released a fixed build. Leadership should prioritize rapid browser fleet remediation because Chrome is widely deployed and user interaction is the only prerequisite for a successful attack.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB