EUVD-2026-105681
GHSA-xxvr-qj4r-xxvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled site
-
DeliveryServe crafted HTML page
-
ExploitTrigger improper input validation in Input component
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactSandboxed code execution (chain with escape for host RCE)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires the victim to load attacker-controlled web content: a crafted HTML page rendered by a vulnerable Chrome build prior to 156.0.8078.47 (UI:R - user must navigate to or open the malicious page). No authentication or special Chrome configuration is required (PR:N), and exploitation works against default Chrome installations. The key LIMITING factor is that resulting code execution is contained within the renderer sandbox per the description, so host-level compromise additionally requires a separate sandbox-escape vulnerability; this materially reduces standalone impact. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a remotely reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page. However, two signals temper the raw score: the description explicitly states code execution is 'inside the sandbox' (Scope:Unchanged is consistent with this - the renderer sandbox is not escaped), and Chromium's own security severity rating is only Medium. A sandboxed renderer compromise is a meaningful but incomplete exploit primitive; it typically must be chained with a separate sandbox-escape bug to achieve host-level RCE. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit code is indicated, so there is no public exploit identified at time of analysis. The 'RCE' tag overstates real-world impact somewhat, since arbitrary code execution here is confined to the sandbox rather than the underlying OS. Net: patch promptly given Chrome's ubiquity and the drive-by delivery model, but this is a medium-real-risk renderer bug rather than a confirmed wormable or actively exploited full-chain RCE. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that triggers the improper input validation flaw in Chrome's Input component. When a victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) means a working exploit would be reliable, though impact is confined to the sandbox absent a chained escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in the Input component of Google Chrome before 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page; no authentication or non-default configuration is required, though user interaction is required to open the page. The vendor has released a patch in Chrome 156.0.8078.47. At time of analysis there is no CISA KEV listing or public exploit code identified, and because code execution is described as contained within the sandbox, standalone host compromise would require an additional sandbox-escape vulnerability.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later through the normal Chrome auto-update mechanism, then restart the browser and verify the version at chrome://version; the vendor advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is https://issues.chromium.org/issues/567673405. ChromeOS administrators should apply the corresponding stable-channel update referenced at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html. No feature-level workaround removes the flaw, so until patching is complete, restrict browsing to trusted sites and enforce enterprise update policies; keep the Chromium sandbox enabled, because disabling it (for example with --no-sandbox) may improve compatibility in some environments but would sharply increase the impact of any successful renderer exploit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-20 improper input validation flaw in Chromium's Input handling, reachable through a crafted HTML page rendered by a vulnerable Chrome build. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High) reflects a remotely reachable, low-complexity issue that requires the victim to navigate to or open attacker-controlled web content but no authentication or special Chrome configuration. The key limiting factor is that the description frames the resulting arbitrary code execution as occurring inside the renderer sandbox, so it does not by itself provide host-level compromise; escaping the sandbox would require a separate vulnerability. The Chromium security severity is Medium, and the underlying issue was reported through Google's Chrome CVE process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N/UI:R; sandbox-confined code execution keeps S:U but still yields full renderer-context C:H/I:H/A:H.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 156.0.8078.47 carry a high-severity input-validation flaw that can allow crafted web pages to run arbitrary code inside the browser renderer sandbox, affecting employees who browse with unpatched Chrome installations. Leadership should prioritize fleet-wide Chrome updating because the browser is broadly deployed, exploitation requires user interaction, and no public exploit or CISA KEV activity has been identified at time of analysis, while a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB