EUVD-2026-111429
GHSA-9q8x-4pg5-5chg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Turbolev
-
ExecutionReclaim freed object with controlled data
-
ImpactAchieve code execution in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.73 (UI:R / user interaction required); no authentication and no special configuration are needed, so default installations are affected. The principal limiting factors are: (1) user interaction - the victim must navigate to attacker-controlled content; and (2) sandbox containment - per the description, arbitrary code execution occurs inside the renderer sandbox (Scope:Unchanged), so reaching the underlying OS requires chaining an additional sandbox-escape vulnerability. Keeping Chrome updated to 156.0.8078.73 or later is the vendor-provided fix. |
| Impact | This is a genuine near-term patching priority, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw whose only gating factor is user interaction (visiting a page). Google itself rates the Chromium severity as High, and a vendor patch is available. The key limiting signal is in the description itself: code execution occurs 'inside the sandbox' (consistent with Scope:Unchanged), so a successful exploit yields only renderer-process compromise and would require a separate sandbox-escape chain to reach the host - this materially lowers real-world impact versus a full RCE. The priority decision label is 'this_week', which aligns with a serious-but-not-active-exploitation posture. EPSS score is not provided in the input, and there is no CISA KEV listing and no public exploit reference (the chromium bug tracker link is an access-restricted issue, not PoC code), so there is no evidence of in-the-wild exploitation at time of analysis. Net: high severity and highly exploitable in principle, but the sandbox containment and absence of KEV/EPSS/PoC signals argue for prompt scheduled patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing specially crafted HTML that triggers the use-after-free in the Turbolev component when rendered by a vulnerable Chrome build. A victim who browses to that page (UI:R) has attacker-controlled code executed within the browser's renderer sandbox. No public exploit code or PoC was identified in the available data, and full host compromise would additionally require a sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Use-after-free in the Turbolev component of Google Chrome allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in builds prior to 156.0.8078.73. The CVSS score is 8.8, but exploitation requires user interaction and the impact remains sandbox-contained, so full host compromise would require chaining an additional sandbox-escape flaw. No public exploit code or active exploitation has been identified at time of analysis; Google has released a fixed build, and the available intelligence supports a near-term patching priority rather than an emergency response.
RemediationAI
Google has released a vendor patch: Chrome 156.0.8078.73. Updating to that version or later is the vendor-provided remediation, distributed through the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html; the associated Chromium issue is https://issues.chromium.org/issues/567129324. No specific workarounds or compensating controls are documented in the supplied references, so the actionable step is to verify and enforce Chrome 156.0.8078.73 or later across managed installations as a this-week priority.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (use-after-free) is a memory-safety flaw in which an object is freed while a reference to it remains; later use of that dangling reference can let an attacker corrupt memory or redirect control flow. In this case the affected component is Turbolev in Google Chrome, and the exact object-lifetime error is not described in the available sources. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a remotely reachable, low-complexity flaw that requires no privileges but does require user interaction; Scope is Unchanged, which is consistent with code execution remaining inside Chrome's renderer sandbox. Affected builds are Chrome versions prior to 156.0.8078.73; the EUVD entry lists the affected version as Chrome 156.0.8078.73 <156.0.8078.73, which in context means releases earlier than 156.0.8078.73. No CPE strings were supplied in the intelligence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Triggered by visiting a crafted page so AV:N/UI:R/PR:N/AC:L; code runs within the renderer sandbox so S:U, with high C/I/A on that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 156.0.8078.73 contain a high-severity use-after-free vulnerability that allows remote code execution within the browser's renderer sandbox. This puts all employees who use Chrome for web browsing at risk, as simply visiting a malicious webpage could compromise their browser session. While no active exploitation has been reported, the availability of a patch means immediate action is required to protect the organization's endpoints and data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB