EUVD-2026-105770
GHSA-q3fq-3v96-65rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers ReadingMode use-after-free
-
ExecutionReclaim freed object in renderer
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled HTML in Google Chrome versions prior to 156.0.8078.47 (UI:R), with no authentication needed (PR:N). The trigger specifically involves the ReadingMode feature processing the crafted page. A critical limiting factor is that code execution is confined 'inside the sandbox' per the description - meaningful host compromise would require chaining a separate sandbox-escape vulnerability, which this CVE does not provide. The requirement for user interaction (visiting/rendering the page) and the sandbox boundary substantially reduce realistic impact relative to the 8.8 score. |
| Impact | Signals conflict and must be weighed carefully. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes network-reachable, low-complexity, unauthenticated code execution requiring only that a victim open a crafted HTML page - a classic drive-by profile. However, the description explicitly states the arbitrary code executes 'inside the sandbox,' and Chromium itself rated this 'Low' severity. That is a meaningful contradiction: an 8.8 numeric score overstates real-world impact because, without a chained sandbox-escape, the attacker is confined to the renderer process and cannot reach the host OS or other origins. No EPSS score, KEV listing, POC, or SSVC decision data was provided. Per precision rules, this is therefore 'no public exploit identified at time of analysis.' The absence of KEV/POC data is not evidence of safety but also does not indicate active exploitation. Net assessment: patch promptly as part of normal Chrome update hygiene given ubiquity and the trivial UI trigger, but this is a lower practical priority than a renderer RCE with a known sandbox escape or confirmed exploitation - the sandbox containment and vendor's own 'Low' rating temper the headline 8.8. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that triggers the use-after-free in Chrome's ReadingMode feature, then lures a victim to visit it (UI:R). When the page is rendered, the freed object is reused to achieve code execution within the renderer sandbox; absent a separate sandbox-escape, impact is confined to the renderer process. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the ReadingMode component of Google Chrome builds prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and Google's own Chromium severity rating for this issue is Low - a sharp conflict with the 8.8 base score that materially changes how the risk should be weighed. Because the description confines the code execution to the sandbox, a complete host compromise would require chaining a separate sandbox-escape bug that this CVE does not supply; no public exploit was identified at the time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later - the fix ships in the desktop stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, with the equivalent ChromeOS build covered at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html. End users can force the update via chrome://settings/help and a restart; managed fleets should shorten the update-pinning/deferral window so the fixed version propagates, and verify the reported version across the estate rather than assuming auto-update succeeded. If immediate rollout is not possible, reduce exposure by keeping the renderer sandbox and site isolation enabled (disabling them to work around unrelated issues would convert this renderer-only bug into a direct host compromise), restricting browsing to trusted origins, and delivering untrusted HTML through a remote-rendering or isolated-browsing tier - accepting the added latency and infrastructure cost. Disabling the Reading Mode feature at the enterprise-policy level, where such a control is available on the managed platform, removes the vulnerable code path entirely at the cost of losing reader-view functionality for users. Because impact here is sandbox-confined, prioritise this below any Chrome update that addresses a sandbox escape or that is reported as actively exploited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-416, use-after-free, in Blink's ReadingMode (reader/distilled-page rendering) implementation. ReadingMode builds an alternate, simplified DOM/rendering tree from the loaded document; objects created for that tree can be released while a stale pointer or handle is still held, so a subsequent access dereferences freed heap memory. An attacker who controls the HTML can attempt to shape heap layout during and after the free, turning the dangling reference into controlled data flow inside the renderer. The important architectural constraint is that this occurs in the renderer process: the exploit primitive lands inside Chrome's site-isolation sandbox, so read/write or control-flow control gained there does not by itself yield OS-level code execution, file access, or credential theft - those require a second, independent sandbox-escape vulnerability. This is the reason the Chromium team scored the issue Low despite the NVD-style vector reading C:H/I:H/A:H, which measures renderer-level consequences. Exploitation prerequisites per the assessed vector are minimal authentication (PR:N) but mandatory user interaction (UI:R): the target must navigate to or render the attacker's page in an affected Chrome build. No CPE-confirmed platform breakdown beyond the Chrome desktop/ChromeOS stable channel advisories is provided in the source data.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page trigger (AV:N/AC:L/PR:N) requiring victim to open the page (UI:R); renderer code execution yields high C/I/A within an unchanged scope (S:U, sandbox not escaped).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a use-after-free flaw in the ReadingMode component that allows arbitrary code execution within the browser's renderer sandbox when a user opens a crafted HTML page. Any employee browsing the web on an unpatched Chrome installation is a potential target, though full device compromise would additionally require a separate sandbox-escape vulnerability not provided by this CVE. Leadership should care because the browser is the primary attack surface across the workforce, and remediation is a straightforward version upgrade.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB