EUVD-2026-105682
GHSA-gxfp-63hq-8m24
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML/PDF page
-
ExploitChrome PDF component parses malicious object
-
ExecutionTrigger use-after-free (CWE-416)
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page containing a malicious PDF in Chrome's built-in PDF viewer (UI:R) - it is not drive-by against a browser sitting idle; user interaction of loading attacker-controlled content is mandatory. No authentication or special privileges are needed (PR:N). The key limiting factor is that successful code execution is confined to the Chrome sandbox per the description, so standalone host compromise additionally requires chaining a separate sandbox-escape vulnerability. Affected deployments are any Chrome desktop installation prior to 156.0.8078.47; Chrome's automatic update mechanism substantially shortens the real-world exposure window. |
| Impact | Signals conflict and must be weighed carefully. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) describes a remote, low-complexity, unauthenticated flaw needing only that a victim open a crafted HTML page. However, Google's own Chromium severity rating is explicitly 'Low,' and the description specifies code execution occurs 'inside the sandbox' - meaning the attacker gains execution within Chrome's renderer/PDF sandbox, not on the host, so a sandbox escape would additionally be required for full system compromise. This gap between a High CVSS (which does not credit the sandbox boundary) and the vendor's Low rating is the single most important nuance: raw CVSS overstates real-world impact here. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation likelihood cannot be quantified - status is 'no public exploit identified at time of analysis.' Use-after-free bugs in a ubiquitously deployed browser are historically attractive to attackers, but without KEV or POC evidence and given the vendor's Low severity, this is a routine patch-cycle issue rather than an emergency. Prioritize via normal Chrome auto-update rather than as a drop-everything incident. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page embedding a malicious PDF and lures a victim to open it in Chrome (UI:R). When Chrome's PDF component processes the crafted document, a use-after-free is triggered, letting the attacker execute arbitrary code - but confined within the browser sandbox, so a separate sandbox escape would be needed to reach the host. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's PDF handling before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the Chrome sandbox when a victim opens a crafted HTML page. The issue is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) but requires user interaction; Chromium's own severity rating is Low, reflecting that code execution is confined to the sandbox and host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released a fixed build.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later; this is the vendor-released patch identified in Google's stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Confirm the installed version in chrome://settings/help or the browser's About page, and fully restart the browser so the updated binary is loaded. Relying on Chrome's automatic update is reasonable for most environments, but managed fleets should force the update and verify compliance. If immediate upgrade is not possible, reduce exposure by disabling Chrome's built-in PDF viewer or configuring PDFs to download instead of opening automatically, accepting the usability and policy-management trade-offs, and restrict untrusted HTML and PDF delivery through email and web gateways. These are compensating controls only and do not fix the underlying memory-safety flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in the PDF component used by Chrome's built-in PDF viewer. A crafted HTML page causes Chrome to process PDF content in a way that leaves a dangling memory reference; reuse of the freed object can corrupt control flow and lead to arbitrary code execution in the renderer or PDF-handling process. Chrome's multi-process sandbox contains that execution, so the immediate impact is arbitrary code execution inside the sandbox rather than direct operating-system compromise; escaping the sandbox requires a second, independent vulnerability. The attack surface is the browser's PDF handling, triggered by loading attacker-controlled HTML, and affected builds are Chrome desktop releases prior to 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); code execution within the renderer sandbox keeps scope unchanged (S:U) while allowing high C/I/A inside that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome's PDF handling contains a use-after-free vulnerability affecting builds prior to 156.0.8078.47 that could let an attacker run code inside the browser sandbox when a user opens a crafted HTML page. Exploitation requires user interaction and stays confined to the sandbox unless chained with a separate escape, so the immediate organizational risk is moderate even though the CVSS score is high. Leadership should treat this as a routine browser hygiene issue affecting the broad Chrome user base, not an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB