EUVD-2026-105720
GHSA-27fc-p5mc-p548
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryDeliver malicious page content to DevTools
-
ExploitTrigger memory corruption in DevTools
-
ExecutionEscape browser sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-crafted HTML page while Chrome DevTools is active, since the memory-corruption flaw resides in DevTools rather than the general rendering path - a significant limiting factor as most users do not browse with DevTools open, which is likely why Chromium rates the issue 'Low' despite the 9.6 CVSS. No authentication is required (PR:N) but user interaction is mandatory (UI:R). The flaw is fixed in Chrome 156.0.8078.47, so only unpatched prior versions are exploitable; successful exploitation results in code execution outside the browser sandbox (scope change). |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) describes a network-reachable, unauthenticated, scope-changing remote code execution outside the browser sandbox - on paper a critical issue. However, Google/Chromium itself labels this 'security severity: Low,' a strong vendor signal that real-world exploitability is constrained, almost certainly because triggering the bug requires the victim to have Chrome DevTools open on an attacker-controlled page, an atypical user state. This vendor-vs-CVSS divergence should be called out: the 9.6 overstates practical risk for the typical user who never opens DevTools. No EPSS score, KEV listing, SSVC decision data, or POC is present in the input, so exploitation probability cannot be quantified from these sources; per precision rules, there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a patched, vendor-rated-Low DevTools memory-corruption bug in an ubiquitous product - worth patching on normal Chrome update cadence, but the headline 9.6 is not matched by vendor severity or any exploitation-probability signal. |
| Exploit ScenarioDerived | An attacker lures a developer or power-user who is browsing with Chrome DevTools open to a crafted HTML page that triggers a memory-corruption flaw in DevTools, corrupting memory to execute arbitrary code outside the renderer sandbox. No authentication is required (PR:N) but user interaction is (UI:R), and no public proof-of-concept exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the DevTools component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code outside the browser sandbox (a scope change from the renderer into the host environment). Exploitation is materially constrained: the defect lives in DevTools rather than the normal rendering path, so the victim must have DevTools open or active while loading the malicious page - which is why Chromium assigns this a 'Low' security severity despite a 9.6 CVSS base score, and our own assessment raises attack complexity to High for the same reason. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor-released fix is Chrome 156.0.8078.47.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later (stable channel update for desktop), following https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; verify the installed version in chrome://version and confirm auto-update is functioning, and track the upstream fix at https://issues.chromium.org/issues/533644359 for those waiting on rebased Chromium downstreams. Where immediate upgrade is not possible, the highest-leverage compensating control is to disable or tightly restrict DevTools via enterprise policy (DeveloperToolsAvailability set to disable DevTools) or by removing developer tooling from non-developer endpoints, since the flaw is only reachable while DevTools is active - the trade-off is that this breaks legitimate debugging and front-end development workflows and will generate user friction. Organizations can additionally restrict browsing to managed, allow-listed sites and isolate high-risk browsing in a disposable VM or remote browser for users who genuinely require DevTools, accepting the overhead and reduced usability. Do not rely on the renderer sandbox as a mitigation here, because successful exploitation results in a scope change and code execution outside the sandbox.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-119 (improper restriction of operations within the bounds of a memory buffer) in Chrome DevTools, the debugging subsystem (front-end UI plus the DevTools backend/agent that communicates over the Chrome DevTools Protocol and can attach to the browser process as well as individual renderers). Because the corruption occurs in that privileged debugging context rather than in the standard renderer content path, the CVSS scope is Changed (S:C): a successful attack is not contained by the renderer sandbox and can lead to code execution at the browser/OS level. The attack vector is network-based with no privileges required (PR:N) but mandatory user interaction (UI:R) - the victim must navigate to the attacker's crafted HTML page while DevTools is in use. The discrepancy between the published 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and our assessed vector (AC:H instead of AC:L) reflects the practical precondition that DevTools be active, which the Chromium team evidently weighted heavily in rating the issue 'Low'. Affected CPE/version data (EUVD) places the fix boundary at Chrome 156.0.8078.47, with all earlier builds exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted page with no auth (AV:N/PR:N/UI:R), but reaching the DevTools code path and winning memory-corruption exploitation is non-trivial, so AC:H; sandbox escape gives S:C and full C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB