EUVD-2026-105762
GHSA-424x-xx6w-9r49
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitLoader parses malicious content
-
ExecutionTrigger out-of-bounds memory read
-
ImpactDisclose sandboxed process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in Chrome prior to 156.0.8078.47 (UI:R) - there is no automatic/zero-click vector. The flaw is reachable in the default configuration via the Loader component with no authentication (PR:N), but impact is strictly limited to reading memory within the renderer sandbox: there is no indicated sandbox escape, write primitive, or code execution. Limiting factors: mandatory user interaction, confinement to sandboxed memory, and the browser's automatic update mechanism which rapidly reduces the vulnerable population. |
| Impact | Signals are consistent and point to a genuinely low-priority issue despite the 6.5 (Medium) CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) describes remote, low-complexity, unauthenticated exploitation but requires user interaction (visiting a crafted page), and impact is confidentiality-only (C:H/I:N/A:N) limited to memory readable inside the renderer sandbox - no code execution and no sandbox escape are claimed. EPSS is low (0.22%, 12th percentile) and the issue is NOT in CISA KEV, with no public exploit identified at time of analysis, aligning with Google/Chromium's own 'Low' severity rating. The main tension is that the 6.5 base score (driven by C:H) overstates real-world risk: Chromium rated this Low and the disclosure is confined to sandboxed memory, so C:H is arguably generous - see assessed vector. Net: not a priority for emergency patching; roll out with the normal Chrome update cadence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption flaw in Chrome's Loader when a victim visits it. Because the issue only allows reading memory inside the sandbox (no RCE or escape), a successful attack would leak limited in-process data rather than compromise the host. No public exploit code has been identified, and exploitation requires the victim to actively load the malicious content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Loader component of Google Chrome versions prior to 156.0.8078.47 allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Impact is confined to information disclosure within the sandbox - there is no indicated write primitive, sandbox escape, or code execution path - and exploitation requires mandatory user interaction (UI:R) with no authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.22% (12th percentile), consistent with an independent assessment lowering the vector to confidentiality-only impact (C:L).
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - this is the vendor-released fix version published in the October 2026 stable channel update (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html); Chrome's automatic update mechanism reduces exposure quickly, but verify via chrome://version and relaunch the browser so the update actually applies. Where immediate patching is not possible, ensure the built-in sandbox and site isolation remain enabled (disabling them to 'fix' rendering problems would materially raise the impact of this bug from sandboxed memory read to host-level risk), and restrict exposure to untrusted HTML by enforcing safe-browsing/proxy filtering of suspicious pages - noting these are compensating controls that reduce, not eliminate, the chance of a user being lured to a crafted page. Because exploitation requires user interaction, reinforcing phishing resistance and click-through awareness is a meaningful secondary mitigation. No vendor-released patch is missing here; admins on managed fleets should push 156.0.8078.47 through their update channels rather than relying on user-initiated updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in Chrome's Loader subsystem, which handles resource/network loading for renderer processes. Google classifies it as Chromium security severity Low. Because the corruption occurs in the sandboxed renderer, an attacker who succeeds can at most read memory within that sandbox - the OS-level sandbox and site isolation remain intact, so this does not chain directly into a full compromise. The affected CPE corresponds to Google Chrome builds below 156.0.8078.47 on desktop; the fix shipped in the 156.0.8078.47 stable channel release documented at chromereleases.googleblog.com, with the underlying engineering discussion tracked in Chromium issue 563016452. Exploitation is browser-typical: a user must be lured to a crafted HTML page, giving the attacker no zero-click path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable via a crafted page (UI:R) with no privileges, but disclosure is confined to sandboxed memory with no integrity/availability impact, so C:L rather than C:H.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB