EUVD-2026-105690
GHSA-mxp9-hfh2-qpjc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Permissions
-
ExecutionReclaim freed object via heap grooming
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to navigate to attacker-controlled or attacker-influenced HTML content using an unpatched Chrome build prior to 156.0.8078.47 (UI:R / UI:P - the user must open the crafted page); no authentication is required (PR:N). The critical LIMITING factor is that resulting code execution is confined to the renderer sandbox per the description - it is NOT a host compromise, so real-world impact depends on chaining a separate sandbox-escape vulnerability. Chrome's silent auto-update mechanism further limits the exposed population to users on outdated or update-disabled installations. |
| Impact | Signals are mixed and must be weighed carefully. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity, unauthenticated bug needing only user interaction, which on paper is a high priority. However, the Chromium project itself rates this a LOW security severity, and the description is explicit that code execution occurs INSIDE the renderer sandbox - not a sandbox escape to the host. This materially lowers real-world impact, because a sandboxed renderer compromise alone cannot read host files or gain host code execution without a second chained bug. This CVSS-vs-vendor-severity gap should be treated as a genuine conflict: the 8.8 reflects worst-case memory-corruption impact, while the vendor's LOW rating reflects the sandbox confinement. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active exploitation or public exploit code. Net assessment: patch via normal Chrome auto-update cadence; this is a routine browser memory-safety fix, not an emergency, absent a sandbox-escape chain partner. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into a page the victim already trusts) that triggers the use-after-free in Chrome's Permissions component when the victim browses to it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which would then typically need to be chained with a separate sandbox-escape vulnerability to compromise the host. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Permissions component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The issue requires user interaction (CVSS UI:R), needs no authentication (PR:N), and carries a CVSS 8.8 base score even though Chromium rates its security severity as Low; the described code execution is confined to the renderer sandbox and would require chaining with a separate sandbox escape for host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later; the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html documents the stable-channel fix and Chrome's auto-update mechanism should deliver it, but users should verify the installed version at chrome://version and restart the browser if an update is pending. Organizations that disable or delay browser updates should push build 156.0.8078.47 through their update-management tooling and confirm compliance. Because exploitation requires a crafted HTML page and remains inside the renderer sandbox, limiting exposure to untrusted HTML and ensuring site isolation remains enabled are compensating controls only and do not replace patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chromium's Permissions implementation manages permission requests and grant state as web content interacts with browser-level permission decisions, with objects passed across renderer and browser boundaries. CWE-416, use-after-free, means an object is freed while a stale reference remains; crafted HTML drives permission-related code into dereferencing freed memory, corrupting renderer state and potentially allowing arbitrary code execution within the sandbox. The CVSS vector AV:N/AC:L/PR:N/UI:R confirms remote reachability without credentials but with required victim interaction to load attacker-influenced HTML. Chromium's Low severity rating and the description's sandbox-internal impact limit the realistic consequence unless the attacker also has a sandbox-escape primitive. No CPE strings were supplied, but the affected build range is Chrome prior to 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to open it (UI:R); memory corruption gives full renderer-process C/I/A impact with no scope change (S:U) since execution stays in the sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.47 contain a high-severity memory-corruption flaw in the browser's Permissions component that can crash or compromise the browser process when a user visits a malicious or compromised web page. The exposure is broad because Chrome is widely deployed across the workforce and exploitation requires only routine browsing activity, though code execution is contained within the browser's renderer sandbox and full host compromise would require an additional, separate exploit. Leadership should care because of the size of the affected population and the low attacker effort, not because of any confirmed targeting.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB