EUVD-2026-105756
GHSA-p472-fwg7-hgc9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious page content to browser
-
ExploitTrigger improper input validation in Passwords
-
ExecutionExecute arbitrary code within renderer sandbox
-
ImpactAccess in-sandbox browsing/site data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to actively open or navigate to an attacker-controlled crafted HTML page in Google Chrome versions prior to 156.0.8078.47 (UI:R). No authentication or special privileges are needed (PR:N). The decisive LIMITING factor is that resulting code execution is confined to the renderer sandbox (S:U, as stated in the description) - the attacker does not gain host-level execution without an additional, separate sandbox-escape vulnerability, which is why Chromium rated the issue 'Low' despite the 8.8 CVSS. Requires an active, supported Chrome desktop install on the vulnerable version range. |
| Impact | Signals are mixed. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H) yields 8.8 (High) and describes network-reachable, low-complexity, unauthenticated code execution requiring only that a victim open a crafted page. However, the description and Chromium's own rating directly contradict the severity: the flaw allows code execution ONLY 'inside the sandbox' and Chromium rated it 'Low'. A sandbox-confined renderer compromise is a materially lower real-world risk than the 8.8 implies, because it does not by itself yield host code execution without a separate sandbox-escape bug - the CVSS score does not model this containment, so treat the 8.8 as an upper bound, not the operational risk. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis'. There is no evidence of active exploitation. Priority is driven almost entirely by Chrome's ubiquity and the patch availability rather than by any confirmed exploitation signal. Recommend routine-but-prompt patching as part of normal Chrome update cadence rather than emergency response. Note the disparity explicitly: NVD-style CVSS 8.8 (High) versus vendor Chromium severity 'Low' - the containment to the sandbox reconciles this gap. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page that abuses the improper input validation in Chrome's Passwords component; when a victim browses to the page, the attacker achieves arbitrary code execution confined to the browser's renderer sandbox. Because the vector requires user interaction (visiting the page) and execution is sandbox-contained, full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in Google Chrome's password-handling component before 156.0.8078.47 allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The issue is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) but depends entirely on user interaction - the target must actively navigate to the attacker-controlled page in a vulnerable desktop Chrome build. Chromium itself rated the flaw 'Low' because the resulting execution stays confined to the sandbox (S:U), meaning host-level compromise would require chaining a separate sandbox-escape vulnerability; no public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the stable channel - the fix is documented in the Chrome releases advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, and fleets should verify the installed build through chrome://version or their software inventory tooling. Enterprise administrators should force the update through Chrome Browser Cloud Management or their OS patch pipeline (e.g. Google Update policy, MSI/PKG deployment) rather than relying on user-initiated restarts, since Chrome only applies updates after a full browser relaunch. Until every endpoint is on 156.0.8078.47, the most effective compensating control is to keep the renderer sandbox fully intact: never launch Chrome with --no-sandbox and do not disable Site Isolation, as the sandbox is precisely what caps this flaw at in-renderer code execution - removing it converts a scoped bug into host-level remote code execution. Reducing exposure to untrusted HTML (restricting browsing to allow-listed sites or isolating Chrome in a remote-browsing/VDI tier) lowers the UI:R-driven attack surface at the cost of user flexibility, and temporarily disabling Password Manager autofill reduces interaction with the affected component but degrades usability and credential-filling workflows. Because exploitation requires the victim to open a crafted page and no public exploit was identified at time of analysis, prioritise patching internet-facing and high-value user populations first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-20 improper input validation in Chrome's Passwords component, the subsystem responsible for credential capture, storage and autofill on crafted or hostile pages. Because the missing validation occurs in code that parses attacker-influenced page content, a malicious HTML document can drive the component into a state that yields memory-corruption-style consequences and arbitrary code execution within the renderer process. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack is network-delivered, requires no privileges, needs the victim to load the page, and - critically - is scoped to the vulnerable component, so the blast radius is the renderer sandbox rather than the host operating system. That scoping, plus Chromium's own 'Low' security severity rating, is why an 8.8 base score coexists with a modest vendor severity: escaping to the desktop would require a second, independent sandbox-escape bug. No CPE strings were supplied in the intelligence feed; the authoritative affected range per EUVD is Chrome builds below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page, no privileges, but requires victim navigation (UI:R); scope unchanged and impacts high only within the renderer sandbox, which containment materially lowers real-world severity.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a high-severity input-validation flaw in the password-handling component that can allow a crafted web page to execute code inside the browser's renderer sandbox when a user navigates to it. The issue is remotely reachable without attacker credentials but requires user interaction, and no public exploit identified at time of analysis; Chromium's lower rating reflects that code execution remains sandbox-confined, with host compromise requiring a separate sandbox escape. Leadership should prioritize remediation because Chrome is broadly deployed and the affected component handles credentials, so successful exploitation could put user account and session data at risk even without full endpoint takeover.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB