EUVD-2026-105676
GHSA-hp3w-wmvr-64g3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers input-validation flaw in Passwords
-
ExecutionEscape renderer sandbox (scope change)
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled crafted HTML page in Chrome (CVSS UI:R), making user interaction the primary limiting factor - there is no fully passive drive-by claim and no authentication is needed (PR:N). It affects default installations of Chrome versions prior to 156.0.8078.47 on the desktop stable channel; no special configuration is stated. The key practical limiter is that the flaw provides only 'potential' out-of-sandbox code execution and Chromium rated it Medium, implying the sandbox escape may not be trivially reliable; updating to 156.0.8078.47 or later fully removes exposure. |
| Impact | Signals conflict sharply on this one. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields a 9.6 'Critical' score describing a network-reachable, unauthenticated sandbox escape with scope change - a top-tier browser bug. However, the Chromium project itself rated this only 'Medium', a notable discrepancy that usually reflects mitigating factors (e.g. difficulty of reliably chaining the input-validation flaw into full out-of-sandbox code execution) not captured by the raw CVSS metrics. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit was referenced, so there is no evidence of active or imminent exploitation. Net assessment: this is a patch-promptly item because of the ubiquity of Chrome and the sandbox-escape potential, but it is NOT a confirmed emergency - the 9.6 'Critical' number overstates the vendor's own 'Medium' triage, and the absence of KEV/POC/EPSS data means real-world exploitability is unproven. Treat as high-priority routine browser patching rather than active-incident response. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a Chrome user to visit it (via phishing link, malvertising, or compromised site). The crafted HTML triggers the improper input validation in the Passwords component, which the attacker attempts to leverage to escape the renderer sandbox and run code on the host. No public proof-of-concept was referenced, and successful out-of-sandbox execution is described as only 'potential', consistent with Chromium's Medium rating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Potential out-of-sandbox code execution in Google Chrome desktop stable releases before 156.0.8078.47 is reachable when a user opens an attacker-crafted HTML page, requiring user interaction but no authentication. The CVSS 9.6 scope-changed score reflects high confidentiality, integrity, and availability impact, but Chromium rates the issue Medium and the advisory describes out-of-sandbox execution as potential rather than demonstrated; a vendor patch is available in 156.0.8078.47, and no public exploit identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later on the desktop stable channel and restart the browser; this is the vendor-released patch and fully removes exposure according to the supplied assessment. Verify the installed version at chrome://settings/help, and use enterprise update policies to force version 156.0.8078.47 as a minimum. If immediate updating is not possible, gate access to high-value web applications from outdated Chrome versions via version-aware conditional access or a web gateway (trade-off: compatibility and false-positive risk), and confine risky browsing to a separate low-privilege profile or disposable VM (trade-off: operational overhead). Disabling Chrome's password manager/autofill may reduce exposure to the Passwords component but is not confirmed to eliminate the flaw and costs user convenience. Vendor advisory: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html ; Chromium issue: https://issues.chromium.org/issues/563352925.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-20 improper input validation in Chrome's Passwords component is the root-cause class: attacker-controlled input from a crafted HTML page is not adequately validated before it is handled by privileged browser logic. The CVSS vector's scope change (S:C) reflects the possibility that exploitation crosses the renderer sandbox boundary to execute code outside the sandbox, which explains the high C/I/A values despite Chromium's Medium severity rating. Affected software is the desktop stable channel before 156.0.8078.47; no special configuration is required according to the supplied assessment, and the primary exploitability limiter is the UI:R requirement for the victim to open the crafted page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the user to visit it (UI:R); escaping the sandbox to the host is a scope change (S:C) enabling full host code execution (C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop releases prior to 156.0.8078.47 carry a critical-rated flaw that could let attacker-crafted web content break out of the browser sandbox and run code on employee endpoints. Although no public exploit has been identified and the vendor describes out-of-sandbox execution as potential rather than demonstrated, Chrome's broad footprint across the workforce makes prompt remediation a leadership-level priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB