EUVD-2026-105714
GHSA-mp52-m3g5-r4g2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalformed network input reaches validation flaw
-
ExecutionTrigger improper input validation in Network component
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to actively open or be redirected to an attacker-crafted HTML page (CVSS UI:R), making user interaction the primary limiting factor; no authentication is required (PR:N) and it works against default Chrome configurations reachable over the network (AV:N/AC:L). The decisive limiting factor is that successful code execution is confined to the renderer sandbox (scope unchanged, S:U) - reflected in Chromium's 'Low' severity rating - so by itself it does not escape to the host or OS and would need to be chained with a separate sandbox-escape to achieve full compromise. Affected builds are Chrome desktop prior to 156.0.8078.47. |
| Impact | Signals conflict sharply and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes network-reachable, low-complexity, unauthenticated code execution requiring only that a victim open a crafted HTML page - the standard scoring for a Chrome renderer RCE. However, the description explicitly states execution occurs 'inside the sandbox' (scope unchanged, S:U), and Chromium's own security triage rated this 'Low' severity. That vendor rating is the key tempering signal: sandboxed code execution without a paired sandbox-escape does not yield host compromise, so the effective real-world impact is well below what the 8.8 implies. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of exploitation probability or active abuse - exploitation status is 'no public exploit identified at time of analysis.' Net judgment: this is a high-CVSS but comparatively low-real-risk issue in isolation; it becomes dangerous mainly when chained with a separate sandbox-escape bug. Given Chrome's ubiquity and a patch being available, routine prompt patching is the appropriate response rather than emergency prioritization. Note the discrepancy explicitly: CVSS 8.8 (High) vs. vendor Chromium severity 'Low' - the gap is explained by sandbox confinement, not by a data error. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a victim into visiting it, triggering improper input validation in Chrome's Network component to run attacker-controlled code within the renderer sandbox. No public exploit code was identified at the time of analysis, and the achieved execution is confined to the sandbox, so meaningful compromise would require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in Chrome's Network component (all desktop builds prior to 156.0.8078.47) allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. Successful exploitation requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), any code execution stays confined to the sandboxed renderer rather than the host OS - which is why Chromium rates this 'Low' despite a base score of 8.8. Exploitation status: no public exploit identified at time of analysis; no CISA KEV listing and no EPSS data were supplied with this record.
RemediationAI
Vendor-released patch: 156.0.8078.47. Upgrade Google Chrome to 156.0.8078.47 or later via the built-in updater (chrome://settings/help) or your enterprise deployment tooling, and verify the reported build number post-update; the stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html documents the fix. Because exploitation requires a victim to load an attacker-crafted page, interim compensating controls include enforcing a policy that blocks or warns on untrusted navigation to unvetted sites and tightening Safe Browsing/URL filtering rules - trading off user flexibility for reduced attack surface - and disabling or restricting the use of untrusted Chrome extensions that could redirect users to crafted content. Additionally, enabling Chrome's site isolation and keeping the renderer sandbox intact preserves the containment boundary this bug depends on: even a successful trigger remains confined to the sandbox unless chained with a separate escape, so avoid launching Chrome with --no-sandbox or other flags that would collapse that boundary. Note that no vendor workaround short of upgrading fully removes the Network-component input-validation defect, and no public exploit was identified at time of analysis, so patch cadence rather than emergency containment is the appropriate response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-20 (Improper Input Validation) and lives in Chrome's Network service, the component responsible for URL parsing, HTTP response handling, and resource loading on behalf of renderers. Insufficient validation of attacker-controlled network-derived input allows memory-safety-relevant state to be corrupted, which the vendor describes as potentially leading to arbitrary code execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity, unauthenticated attack that nevertheless hinges on a victim opening or being redirected to a malicious page; the S:U component is critical - the attacker gains code execution with the privileges of the sandboxed renderer, not the browser process or the operating system. Chromium's own severity rating of 'Low' reflects this containment boundary, so this issue is best treated as a sandbox-confined code-execution primitive that would require chaining with a separate sandbox-escape to yield full host compromise. No CPE strings were included in the supplied data, so affected coverage is derived from the vendor advisory and EUVD version range.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim interaction (UI:R, PR:N); code runs in the renderer with no sandbox escape, so S:U with high in-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop deployments prior to 156.0.8078.47 contain a high-severity input-validation flaw in the Network component that could allow a remote attacker to run code inside the browser's renderer sandbox if a user opens a crafted HTML page. Because exploitation requires user interaction and remains confined to the sandbox, the risk to the host operating system is reduced, but browser-session data and user productivity are still exposed. Leadership should prioritize updating Chrome across the fleet, especially for users who browse untrusted content.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB