EUVD-2026-105739
GHSA-2h2h-w649-pq69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Chromoting
-
ExecutionExecute arbitrary code within sandbox
-
ImpactAttempt sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively navigate to or render an attacker-controlled crafted HTML page (UI:R / user interaction), affecting Chrome's Chromoting (Chrome Remote Desktop) component in versions prior to 156.0.8078.47. Critically, successful code execution is confined to within the browser sandbox per the vendor description - achieving host-level compromise requires chaining a separate sandbox-escape vulnerability, which this CVE does not provide. This containment is the primary limiting factor and is why Chromium rates it Low despite the 8.8 CVSS. Mitigated by Chrome's automatic update mechanism, which rapidly deploys the fixed version to most installations. |
| Impact | Signals conflict sharply and must be reconciled before prioritizing. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) treats this as near-critical remote code execution, yet Google's own Chromium severity rating is explicitly 'Low', and the description states code execution is confined 'inside the sandbox' - meaning the renderer/component sandbox contains the outcome and no scope change or host compromise is claimed (consistent with S:U). The high C/I/A values in the input vector appear to overstate real impact because they do not account for sandbox containment; a full chain to meaningful compromise would require a separate sandbox-escape bug, which is not described here. No EPSS score, no CISA KEV entry, and no public exploit were provided, so there is no public exploit identified at time of analysis. Net: this is a patch-on-normal-cadence browser bug, not an emergency - the headline 8.8 is driven by the automated vector, while the vendor's Low rating and the sandbox limitation are the more reliable indicators of real-world risk. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption flaw in Chrome's Chromoting (Chrome Remote Desktop) component when a victim visits it. Successful exploitation yields arbitrary code execution limited to within the browser sandbox, requiring a further sandbox-escape to affect the host. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Chromoting component (Chrome Remote Desktop) prior to 156.0.8078.47 allows an unauthenticated remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Successful exploitation requires user interaction, and code execution is confined within the sandbox, so host-level compromise would require chaining a separate sandbox-escape vulnerability that this CVE does not provide. Chromium rates the issue Low despite NVD's 8.8 score, and no public exploit was identified at time of analysis; a vendor patch is available.
RemediationAI
Vendor-released patch: Google Chrome 156.0.8078.47. Upgrade to 156.0.8078.47 or later using Chrome's built-in update mechanism or managed deployment, then restart the browser to complete installation; see the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. For managed fleets, enforce auto-update or push the fixed build promptly. If Chromoting/Chrome Remote Desktop is not required, disabling or removing that component reduces exposure, with the trade-off of losing remote-support capability. Because code execution is contained within the browser sandbox, this CVE should be prioritized below sandbox-escape issues, but it should still be patched; no public exploit was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and affects Chromoting, the Chrome Remote Desktop component that handles remote-session functionality inside Chrome. A crafted HTML page can trigger memory corruption in this component, potentially leading to code execution, but the independent assessment reduces confidentiality, integrity, and availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) because execution remains contained inside Chrome's sandbox. This explains the sharp signal conflict: NVD lists a high base score of 8.8, while Chromium assigns Low severity and the assessed vector reflects constrained impact requiring user interaction and a separate sandbox escape for host compromise. No CPE strings were supplied, so affected-product identification relies on the vendor version range and advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page attack needs user interaction (UI:R, PR:N); impact downgraded to C/I/A:L because code execution is contained within the sandbox (S:U, no host compromise).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome's Chromoting/Chrome Remote Desktop component prior to 156.0.8078.47 contains a memory-corruption flaw that could allow a crafted web page to run code within the browser sandbox after user interaction. A vendor patch to 156.0.8078.47 is available, and no public exploit identified at time of analysis; organizational risk is concentrated in unpatched Chrome endpoints and users who rely on remote-desktop features, but broad browser exposure still warrants prompt remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB