EUVD-2026-105707
GHSA-54w5-q8rw-hrwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger DevTools memory corruption
-
ExecutionCorrupt memory via buffer overflow
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.47 (UI:R user interaction is mandatory). The flaw resides in DevTools, and critically the resulting arbitrary code execution is confined to the renderer sandbox - the attacker does NOT gain host/OS execution without chaining a separate sandbox-escape vulnerability, which is the primary factor limiting real-world severity. No authentication is required (PR:N), and default configurations are affected, but the user-interaction requirement and sandbox containment meaningfully constrain practical impact. |
| Impact | Signals are mixed and warrant careful prioritization. The NVD CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a victim open a crafted HTML page - attractive on paper. However, the description and Chromium's own 'Low' severity rating both state that code execution is confined INSIDE the renderer sandbox; no sandbox escape is claimed, which is the dominant reason the vendor downgraded it despite the automated 8.8. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation. This creates a notable tension: CVSS 8.8 (high) vs. Chromium severity Low vs. absent exploitation signals. Realistically this is a patch-on-normal-cadence browser bug, not an emergency - the high CVSS overstates real-world impact because the sandbox containment caps the blast radius, and sandbox-only memory corruption typically requires chaining with a separate escape bug to achieve host compromise. Prioritize via routine Chrome auto-update rather than emergency out-of-band response, while noting that any future pairing with a sandbox-escape chain would raise urgency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the DevTools memory-corruption condition, then lures a Chrome user to visit it (UI:R). Successful exploitation yields arbitrary code execution confined to the renderer/sandbox process, not the host OS. No public exploit code was identified at the time of analysis, and reaching host-level impact would require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the DevTools component of Google Chrome lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.47. The CVSS vector requires no privileges (PR:N) but does require user interaction (UI:R), and the resulting code execution is contained by Chrome's sandbox, so host or OS compromise would need a separate sandbox-escape chain. Google assigns only a Low Chromium severity even though the published base vector reads 8.8, and our assessment (C:L/I:L/A:L) reflects the sandbox containment; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
RemediationAI
Upgrade to Google Chrome 156.0.8078.47 or later - the vendor-released patch version - and fully restart the browser so the new renderer binary loads; verify the installed version at chrome://version and push the update through the normal Chrome auto-update or enterprise MSI/PKG channel, referencing the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the tracking bug at https://issues.chromium.org/issues/514508203. If immediate fleet-wide upgrade is not possible, set the Chrome enterprise policy DeveloperToolsAvailability to 2 (disable DevTools entirely), which removes the reachable surface but breaks developer tooling and debugging workflows for all managed users, or to 1 to block it only on extension-forced contexts as a milder compromise. Keep Site Isolation and the renderer sandbox enabled - they do not prevent this corruption but they do contain the post-exploitation code execution to the renderer, which is the main reason impact is limited here - and prioritise the update on endpoints where users routinely open untrusted HTML, mail attachments or links, since exploitation in those contexts requires only a page view. For embedded Chromium consumers (Electron, CEF, headless automation images), track the upstream Chromium 156.0.8078.47 rebase and rebuild rather than waiting for a framework-specific advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-119, improper restriction of operations within the bounds of a memory buffer, meaning a length, index, or offset used while handling attacker-influenced data is not validated before a read or write, producing an out-of-bounds condition that corrupts adjacent heap or object memory. The affected subsystem is DevTools, Chrome's inspector front-end/back-end pair that communicates over the Chrome DevTools Protocol and is built on Blink and V8 internals; because DevTools parsing and object marshalling run inside the renderer process, a crafted HTML page that drives the vulnerable code path can achieve controlled memory corruption and, in the worst case, arbitrary code execution at renderer privilege. That execution is still bounded by the Chromium renderer sandbox, so the security boundary is only crossed if the attacker additionally chains a sandbox-escape vulnerability. The affected CPE population is Google Chrome on Windows, macOS and Linux at versions below 156.0.8078.47; Chromium-derived builds that have not picked up the upstream fix inherit the same flaw.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page attack needs victim interaction (UI:R) but no auth (PR:N); impacts reduced to Low because execution is sandbox-confined with no demonstrated scope change or host access.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a DevTools memory-corruption flaw that can allow a crafted webpage to run code within Chrome’s renderer sandbox, affecting users who browse untrusted content. Leadership should care because Chrome is broadly deployed, but near-term enterprise risk is moderated by sandbox containment, required user interaction, and the absence of identified public exploit code at time of analysis. Patching managed Chrome fleets remains important to reduce exposure and maintain browser hygiene.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB