EUVD-2026-105747
GHSA-xph6-67gq-rcq2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious HTML to Chrome
-
ExecutionTrigger memory corruption in DevTools
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to actively open or visit attacker-controlled crafted HTML in a vulnerable Chrome build (prior to 156.0.8078.47); this UI:R requirement is the primary limiting factor. The flaw resides in DevTools-related handling, and successful exploitation yields code execution only within the Chrome sandbox - not on the host - so standalone impact is contained unless chained with a separate sandbox-escape vulnerability. No authentication is required (PR:N), and no non-default configuration is indicated by the description; the main real-world constraints are the need for victim interaction and the sandbox containment boundary. |
| Impact | Signals are mixed and warrant nuance. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) describes network-reachable, low-complexity, unauthenticated code execution requiring only that a victim open a crafted HTML page. However, the vendor's own Chromium security severity is explicitly rated 'Low', and the description qualifies the outcome as code execution 'inside the sandbox' - i.e., confined to the renderer/DevTools process rather than a full sandbox escape to the host. This is a notable conflict: the CVSS High score does not account for Chrome's sandbox as a mitigating boundary, whereas the vendor rating does. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided, so exploitation probability cannot be quantified from the input; per precision rules this is treated as no public exploit identified at time of analysis. Net assessment: this is a patch-worthy browser flaw but is realistically a lower operational priority than the raw 8.8 suggests, because exploitation requires user interaction and, on its own, yields only sandboxed execution that would need to be chained with a separate sandbox-escape bug to achieve host compromise. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the DevTools memory-corruption condition, then lures a Chrome user to visit it. When the page is rendered the buffer-related corruption (CWE-119) is triggered, potentially allowing arbitrary code execution confined to the browser sandbox. No public exploit code was identified in the provided data, and successful attack depends on the required user interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the DevTools component of Google Chrome builds prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the Chrome sandbox when a victim opens a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is required, but exploitation hinges on user interaction (UI:R), and code execution is confined to the renderer sandbox unless chained with a separate sandbox-escape flaw. No public exploit code or CISA KEV active-exploitation entry is in the available data, and Chromium rated the underlying security severity as Low despite the 8.8 CVSS base score.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; confirm the installed version from chrome://version and restart the browser so the new binary is loaded. Where central management exists, push 156.0.8078.47 through enterprise update policies and verify fleet compliance, since unpatched endpoints remain exposed to crafted HTML. As a compensating control pending rollout, restrict DevTools availability and enforce enterprise policies that block untrusted sites and disable developer-tools access for non-essential users, accepting reduced debugging capability as the trade-off; additionally, keeping site isolation enabled limits the blast radius of any renderer compromise, though this does not remove the memory-corruption bug itself. Users should treat links and HTML attachments from untrusted sources with caution until the update is applied, as user interaction is the exploitation prerequisite.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-119 (improper restriction of operations within the bounds of a memory buffer), a classic memory-safety defect in which out-of-bounds read/write access in native code can lead to corruption that an attacker may steer toward controlled code execution. Here the flaw lives in DevTools handling within the Chromium browser, the same open-source core that Google Chrome at version 156.0.8078.47 is built upon; the EUVD data treats all Chrome builds below that release as affected. Because DevTools functionality is exposed to page-level content in certain flows, a crafted HTML page can reach the vulnerable parsing/handling path, and the description frames the outcome as potential arbitrary code execution but explicitly inside the sandbox - the browser's renderer containment boundary - meaning host-level compromise would require an additional sandbox-escape primitive. Chromium's own severity rating of Low suggests the practical exploitation path is constrained, which conflicts with the 8.8 CVSS base score derived from high confidentiality/integrity/availability impact on the sandboxed component.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must open it (UI:R); memory corruption permits high C/I/A within the component, scope unchanged as execution stays inside the sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome builds before 156.0.8078.47 expose the organization to a high-severity DevTools issue that could allow code execution inside the browser sandbox when a user visits a crafted page. Leadership should treat this as a broad fleet-hygiene risk: the attack is unauthenticated but requires user interaction, impact is contained to the renderer unless chained with a separate escape, and no public exploit was identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB