EUVD-2026-105764
GHSA-8w28-r4c7-vgvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers memory corruption in Google Lens
-
ExecutionAchieve arbitrary code execution in renderer sandbox
-
ImpactChain with separate escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open a crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.47 that invokes the affected Google Lens code path (UI:R - user interaction is mandatory, so no fully passive/driveby-without-navigation exploitation). Critically, resulting code execution is confined to the renderer sandbox (S:U, scope unchanged per the description's 'inside the sandbox'); escaping to the host requires an additional, separate sandbox-escape vulnerability not covered by this CVE. Primary limiting factors: mandatory user navigation to attacker content, sandbox confinement of the payload, and dependence on Chrome versions below the fixed build. |
| Impact | Signals are mixed and should be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction (visiting a page), with high impact to confidentiality, integrity, and availability. However, three factors materially lower real-world risk: (1) Google/Chromium rated this 'Low' severity, directly conflicting with the 8.8 CVSS - a strong signal that Google considers practical impact limited, likely because (2) the description explicitly states code executes 'inside the sandbox' (S:U, scope unchanged), meaning this is NOT a full sandbox escape and an attacker would still need a separate escape chain to affect the host; and (3) no KEV listing and no POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' EPSS was not provided. The CVSS-vs-vendor-severity divergence is the key tension: the 8.8 reflects renderer-process RCE in the abstract, while Google's 'Low' reflects sandbox containment. Net assessment: patch promptly as part of normal Chrome update hygiene, but this is not an emergency drop-everything issue absent a chained escape. Verify EPSS independently, as it was absent from the data. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malformed content that triggers the Google Lens memory-corruption bug, then lures a victim (via link, ad, or watering-hole) to visit it in a vulnerable Chrome build. On load, the crafted HTML corrupts memory and achieves arbitrary code execution within the renderer sandbox; a full host compromise would require pairing this with a separate sandbox-escape vulnerability. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Google Lens component of Google Chrome desktop builds before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (the victim must navigate to attacker-controlled content), and the resulting code execution remains confined to the Chrome renderer sandbox; reaching the host operating system would require a separate sandbox-escape flaw. Google rates the issue Low (Chromium severity) despite the 8.8 CVSS score, no public exploit has been identified at time of analysis, and the vendor has released a fixed build (156.0.8078.47).
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later, restart all browser processes, and verify the installed build via chrome://version. Enterprise fleets should push the update through their management tooling and confirm the build on endpoints, since managed instances may not auto-update immediately. If the update cannot be applied at once, reduce exposure by disabling the Google Lens/visual search feature through an applicable enterprise policy where your Chrome version supports one, accepting the loss of Lens functionality, and by restricting users from opening untrusted HTML content; because exploitation requires navigation and remains sandbox-confined, these measures lower likelihood but do not remove the memory-corruption bug. See the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue at https://issues.chromium.org/issues/563183231.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-113286 is a CWE-119 memory-buffer bounds violation in Chrome's Google Lens implementation. Google Lens processes visual-search content, and a crafted HTML page can drive the affected code path into an out-of-bounds memory operation. Because Chrome renders untrusted content in a separate, sandboxed process, the immediate consequence is arbitrary code execution with the privileges of the renderer, not the host. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network reachability, no privileges, mandatory user interaction, and unchanged scope. The Low Chromium severity reflects the user-interaction requirement and sandbox confinement; a full compromise would chain this bug with an independent sandbox escape. The fix is in Chrome 156.0.8078.47, and the issue is tracked as Chromium issue 563183231.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user navigation (UI:R); execution stays in the renderer sandbox so scope is unchanged (S:U) with high renderer-process C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop builds prior to 156.0.8078.47 contain a memory-corruption flaw in the Google Lens component that could allow an attacker to run code within the browser's renderer sandbox when a user visits a crafted web page. Although rated High at 8.8 CVSS, the vendor assesses real-world risk as Low because code execution stays confined to the sandbox, requires user interaction, and no public exploit has been identified at time of analysis. Leadership should care primarily because Chrome is widely deployed across the workforce and unpatched browsers represent an avoidable exposure that is fully remediated by a routine version update.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB