EUVD-2026-105701
GHSA-pf3c-g7mf-3r6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryDeliver malicious Network-component payload
-
ExploitTrigger memory corruption (CWE-119)
-
ExecutionExecute arbitrary code in renderer
-
ImpactImpact contained within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to actively visit an attacker-controlled web page containing crafted HTML that reaches Chrome's Network component (UI:R confirms required user interaction). No authentication is needed (PR:N). The critical LIMITING factor is that resulting code execution is contained 'inside the sandbox' - per the description - so by itself it does not compromise the host OS; a separate sandbox-escape vulnerability must be chained to achieve host-level impact. This containment is why Google rated the issue Chromium-Low despite the 8.8 CVSS. Affected deployments are any Chrome desktop installation prior to 156.0.8078.47. |
| Impact | Signals conflict sharply here, and that tension is the headline. The input CVSS base score is 8.8 (High) with a clean remote vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H), yet Google's own Chromium security team rated this only 'Low' severity. The reconciling detail is in the description: code execution is achieved 'inside the sandbox' - i.e., confined to the renderer process without a sandbox escape - which is why the vendor's practical rating is far below the mechanical CVSS number. No EPSS score, SSVC decision data, KEV listing, or public POC was provided, so there is no evidence of real-world exploitation; exploitation status is 'no public exploit identified at time of analysis.' Memory-corruption renderer bugs rated Low by Chromium are rarely weaponized in isolation because they must be chained with a separate sandbox-escape bug to cause host impact. Net assessment: patch via normal Chrome update cadence, but this is NOT an emergency-priority issue despite the 8.8 - the high CVSS reflects raw impact metrics, while the sandbox containment and vendor 'Low' rating indicate low real-world risk absent a chained escape. Verify EPSS/KEV independently, as neither was supplied. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted HTML that triggers the memory-corruption flaw in Chrome's Network component, then lures a user to visit it (UI:R). Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which the attacker would then need to pair with a separate sandbox-escape vulnerability to compromise the host. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Network component before 156.0.8078.47 can let an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim visits a crafted HTML page. The 8.8 CVSS reflects high confidentiality, integrity, and availability impact with user interaction required (UI:R) and no privileges (PR:N), while Google's Chromium-Low severity and the sandbox containment mean host compromise requires chaining a separate sandbox escape. No public exploit code was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fix.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later through the built-in updater or the vendor's stable-channel release, then restart the browser and verify the version; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Because the reported impact is contained inside the sandbox, do not disable Chrome's sandbox as a workaround, and keep site isolation and other browser mitigations enabled; disabling them would remove the main control that limits this bug's blast radius. If patching must be deferred, temporarily restrict users to trusted sites via enterprise URL allowlisting or a managed browser policy, accepting the productivity trade-off, and prioritize updates for users who browse untrusted content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 identifies improper restriction of operations within a memory buffer, and in this case the corruption is reachable through Chrome's Network component while processing a crafted HTML page. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector describes a remote, low-complexity attack that requires the victim to load attacker-controlled content but no authentication; scope remains unchanged because the impact is bounded by Chrome's sandbox. The 'inside the sandbox' wording is central: the bug can yield code execution in the browser's constrained environment, but not direct host-level compromise unless paired with a sandbox-escape vulnerability. The Chromium issue tracker entry (issues.chromium.org/issues/513692667) and Google's stable-channel advisory provide the technical provenance; EUVD lists Chrome versions below 156.0.8078.47 as affected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no auth but requires the victim to visit it (UI:R); impacts are high within the compromised renderer, though scope stays unchanged (S:U) as execution is sandbox-contained.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome builds below 156.0.8078.47 carry a memory-corruption flaw in the browser's Network component that lets a crafted web page execute attacker code inside the browser sandbox on any workstation that loads it. Because Chrome is the primary browser for most of the workforce, the exposure reaches essentially every internet-facing role, and although the sandbox confines a single flaw to the browser process, pairing it with a separate sandbox escape would yield full endpoint compromise. Leadership should care because this is closed by a routine, centrally deployable browser update rather than any architectural change, and the attack path requires nothing more than ordinary web browsing.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB