EUVD-2026-111470
GHSA-53qh-w4cj-2jqw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious HTML to renderer
-
ExecutionTrigger use-after-free in WTF
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build prior to 156.0.8078.73 (UI:R - user interaction via navigation). No authentication or special privileges are needed (PR:N), and default configurations are affected since this is a flaw in a core browser component (WTF). The key limiting factor is that resulting code execution is confined to the renderer sandbox (S:U); converting this into host-level compromise requires chaining a separate sandbox-escape vulnerability. The precise trigger mechanism (the object lifecycle causing the use-after-free) is not described in the available sources. |
| Impact | This is a genuine high-priority issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the classic browser drive-by profile. CWE-416 (use-after-free) in Chrome's WTF (Web Template Framework) base library is a memory-corruption class that historically yields reliable renderer exploitation. Critically, the description states code execution occurs 'inside the sandbox' (S:U, no scope change), so by itself this grants only renderer-level compromise; full host takeover would require chaining an additional sandbox-escape bug. On the exploitation signals: no EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is NOT confirmed as active or public - the vuln.today 'this_week' decision label reflects priority driven by severity and the general exploitability of Chrome UAF bugs rather than observed in-the-wild activity. The chromium issue-tracker reference (575851252) is a standard vendor bug record, not verified working exploit code. Net: patch promptly within the vendor's normal cycle, but there is no evidence this is being actively exploited. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's WTF component when a victim visits it, achieving arbitrary code execution within the renderer sandbox. No public exploit was identified at time of analysis, and meaningful host compromise would still require a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Use-after-free in Google Chrome's WTF component before 156.0.8078.73 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, with CVSS 3.1 scored 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Impact stays confined to the sandbox unless chained with a separate sandbox escape, and the precise trigger is not described in the supplied sources. Vendor-released patch: 156.0.8078.73; no public exploit was identified at time of analysis, and this is assessed as a genuine high-priority issue for this week rather than an emergency.
RemediationAI
Update Google Chrome to 156.0.8078.73 or later through the stable-channel release described in the vendor advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html), then restart the browser so the new build is loaded. The Chromium issue tracker entry is https://issues.chromium.org/issues/575851252. The provided sources do not describe a workaround; applying the vendor update is the documented fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-416 (use-after-free) in WTF, the Web Template Framework library underlying Blink in Chromium, so a dangling reference in a core browser component can be reached with attacker-supplied HTML content. The CVSS vector indicates network reachability, low attack complexity, no privileges required, and user interaction through page navigation; the resulting code execution is bounded by the renderer sandbox (S:U), meaning host-level compromise would require an additional sandbox-escape vulnerability. Affected builds are Chrome releases prior to 156.0.8078.73, and default configurations are exposed because this is a core browser component. The specific object lifecycle and crafted-HTML trigger are not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted HTML page is network-delivered and low-complexity with no auth (AV:N/AC:L/PR:N) but needs the victim to open it (UI:R); sandbox-confined RCE yields S:U with full C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.73 contain a high-severity use-after-free vulnerability that could allow an attacker to execute code within the browser's renderer sandbox. This affects all employees using unpatched Chrome, but the impact is confined to the sandbox unless chained with a separate exploit, so immediate enterprise-wide compromise is unlikely. Leadership should prioritize patching to maintain endpoint security and prevent potential escalation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB