EUVD-2026-105697
GHSA-rhhf-x9q3-cm3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger FullScreen input-validation flaw
-
ExecutionExecute attacker code in renderer
-
ImpactCode runs confined within sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled crafted HTML page in Chrome and involves the browser's FullScreen feature path (UI:R in the CVSS vector), so it cannot be triggered without user interaction. No authentication is required (PR:N). The key limiting factor is sandbox containment: per the description and Chromium's 'Low' severity rating, resulting arbitrary code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be needed for host-level compromise. Affects Chrome versions prior to 156.0.8078.47 on desktop; updating to 156.0.8078.47 or later remediates it. |
| Impact | Signals conflict sharply and this must be stated explicitly: the NVD CVSS 3.1 vector scores this 8.8 (High) with AV:N/AC:L/PR:N/UI:R, yet Google's own Chromium security team rated the bug severity 'Low'. The gap is explained by scope - the description states code execution occurs 'inside the sandbox,' meaning a successful exploit is contained within the renderer process and does NOT by itself grant host compromise; it would need to be chained with a separate sandbox-escape bug to achieve full RCE. The CVSS S:U (scope unchanged) is consistent with this containment. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or available exploit code. Net assessment: patch promptly as part of normal Chrome update hygiene given ubiquitous deployment and the UI:R trigger being trivial (visiting a web page), but this is not an emergency-priority, high-real-risk issue in isolation - the Chromium 'Low' rating is the more realistic risk indicator than the 8.8 NVD score. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page exploiting improper input validation in Chrome's FullScreen handling and lures a victim to visit it (UI:R). When the page loads, the flaw is triggered and attacker-controlled code runs within the browser's sandboxed renderer process. No public exploit code was identified in the provided data, and the resulting execution is confined to the sandbox unless chained with a separate escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in Google Chrome's FullScreen implementation before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page. The score picture is contradictory and must be read carefully: NVD's CVSS 3.1 vector rates this 8.8 (High, AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H) while Google's Chromium security team assigned it a 'Low' severity, reflecting that the resulting code execution is expected to be contained by the sandbox and that exploitation requires user interaction (the victim must load the attacker's page). No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and only desktop Chrome builds prior to 156.0.8078.47 are affected; the vendor has released a fixed version.
RemediationAI
Vendor-released patch: 156.0.8078.47. Update Chrome to 156.0.8078.47 or later - the stable-channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) documents the release, and the browser will pick it up automatically; verify via chrome://settings/help and force a relaunch, or push the version through enterprise update policies (Chrome for Enterprise / managed browsers) and confirm fleet compliance. Because exploitation requires the user to open a crafted page, interim risk reduction centers on keeping the renderer sandbox intact and enabled - do not run Chrome with --no-sandbox or with the sandbox disabled, since that would convert a sandbox-confined code-execution bug into host-level compromise - and on restricting browsing to trusted content and blocking untrusted pages at the proxy until the update lands (trade-off: reduced user flexibility). Note that the 'Low' Chromium severity does not mean the bug is harmless; it means the sandbox contains it, so treating the 8.8 NVD score as the sole prioritization driver would over-state urgency while ignoring the update would still leave a code-execution primitive reachable through any crafted page.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-20 improper input validation defect in the browser's FullScreen feature path, the component that handles the fullscreen API and the associated user-consent UI/state transitions. Because the input handling is insufficiently validated, a crafted HTML page can drive the FullScreen code path into an unexpected state that permits memory-corruption-style outcomes and ultimately arbitrary code execution. The CVSS vector's UI:R reflects that the attack is not self-triggering: the victim must navigate to or open the attacker-controlled page, and no credentials are needed (PR:N). Critically, the scope is unchanged (S:U) and Google rates the issue 'Low' because execution is confined to the renderer sandbox - a separate sandbox-escape bug would be required to reach the host OS, which is why the NVD 8.8 score overstates real-world risk relative to the Chromium team's rating. The affected code ships in the Chromium open-source browser core, so Chrome desktop channels prior to 156.0.8078.47 carry the defect; EUVD records the affected range as versions below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); S:U reflects sandbox containment, with high renderer-context impact matching the NVD vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain an input validation flaw in the FullScreen component that could allow an attacker to run code within the browser's renderer sandbox if a user is persuaded to visit a crafted page. Leadership should care primarily because Chrome is widely deployed across the workforce and remediation is a routine browser update, not because this represents an urgent, actively exploited threat - no public exploit code or confirmed exploitation exists, and Google assesses the sandbox as containing the impact.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB