EUVD-2026-111468
GHSA-jmm5-c8fp-h39g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Browser component
-
ExecutionCorrupt freed object memory
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content: a crafted HTML page rendered by a vulnerable Google Chrome build earlier than 156.0.8078.73 on Windows. This is the UI:R limiting factor in the CVSS vector - exploitation is not fully drive-by/zero-click; the user must navigate to or be served the malicious page. No authentication is required (PR:N). A further limiting factor is that the described outcome is code execution confined to the Chrome sandbox (S:U, no scope change), so by itself this does not grant host-level compromise without an additional sandbox-escape chain. The condition is platform-specific to Windows per the description. |
| Impact | Severity signals are moderately strong but the real-world picture is mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug (CWE-416 use-after-free) that nonetheless requires user interaction - the victim must open a crafted HTML page. Critically, the description scopes the outcome as code execution inside the sandbox (S:U, no scope change), meaning this is a browser-process compromise bounded by the Chrome sandbox rather than a full host takeover on its own. The vuln.today priority is 'this_week', consistent with a High-severity Chromium fix rather than an emergency. No EPSS score was provided, so exploitation probability cannot be quantified; no CISA KEV listing is present, so there is no confirmation of active exploitation; and the input does not mark a working PoC as confirmed. The Chromium issue tracker reference (issues.chromium.org/575090745) is typically access-restricted and is not verified exploit code. Net: a genuinely important browser patch given Chrome's ubiquity, but on this evidence it is a priority-patch item (patch this week) rather than a confirmed in-the-wild emergency; the sandbox-bounded impact and UI:R requirement temper the raw 8.8 score. |
| Exploit ScenarioDerived | A remote attacker hosts or injects a crafted HTML page and lures a victim running a vulnerable Chrome build on Windows to visit it (the UI:R requirement). Rendering the page triggers the use-after-free in the Browser component, giving the attacker arbitrary code execution within the Chrome sandbox. No public, verified exploit code is identified in the supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Use-after-free memory corruption in Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.73. Exploitation is not zero-click - it requires the user to navigate to or be served the malicious content (the UI:R factor in the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) - and the resulting code execution is confined to the Chrome sandbox, so host-level compromise would additionally require a separate sandbox-escape chain. Google rates the issue Chromium security severity High and has released a stable-channel fix; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw is tracked with a this_week remediation priority.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Windows to 156.0.8078.73 or later via the stable-channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html; the same release is indexed as EUVD-2026-111468. Chromium fixes of this class are distributed through the browser's own update mechanism, so confirm the deployed version on managed endpoints and force an update check where auto-update is constrained. The supplied references document no compensating controls, feature toggles or configuration workarounds for this issue, and the flaw is a memory-safety defect in the browser core rather than a disableable feature, so there is no evidence-based mitigation short of applying 156.0.8078.73. Because the assessed impact is arbitrary code execution inside the sandbox (S:U), any residual exposure should be evaluated on the basis that host compromise would require an additional sandbox-escape vulnerability; no public exploit code was identified at time of analysis, and the issue carries a this_week priority rather than confirmed active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (use after free), a memory-safety class in which a heap object is freed while a reference to it remains reachable, so later dereference of the dangling pointer can be repurposed by an attacker to corrupt memory. The affected technology is the Chromium/Blink rendering stack shipped in Google Chrome for Windows; the advisory attributes the flaw to "Browser" without naming a more specific component, so the precise subsystem and the exact way the crafted page triggers the free-then-use sequence are not described in the available sources. The severity metadata (AV:N/AC:L/PR:N) describes network-delivered content reachable without credentials, while UI:R reflects that the victim must render attacker-controlled HTML. Because the CVSS scope is unchanged (S:U), the assessed impact is arbitrary code execution within the renderer/sandbox boundary rather than a privilege escalation to the operating system, and the description limits the affected platform to Windows. Consistent with Chromium practice, this bug was fixed silently in a stable-channel update rather than disclosed in advance.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable UAF triggered by visiting a crafted page (AV:N/AC:L/PR:N/UI:R); impact is high but confined within the sandbox, so scope unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Windows contains a use-after-free vulnerability (CVE-2026-118330) that could allow an attacker to execute code within the browser sandbox when a user visits a malicious webpage. This affects all employees using Chrome for web browsing and poses a risk of unauthorized code execution, though host compromise would require an additional sandbox escape. Leadership should prioritize patching to prevent potential exploitation and maintain security posture.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB