EUVD-2026-113426
GHSA-72w3-57x2-f2v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Network component
-
ExecutionExecute arbitrary code in renderer sandbox
-
Impact(requires separate escape for host compromise)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content: a crafted HTML page rendered by Google Chrome prior to 156.0.8078.79 (UI:R). No authentication or prior privileges are needed (PR:N), and the attack is network-delivered against default configurations - no special Chrome feature or non-default setting is named in the available sources. The key limiting factors are: (1) mandatory user interaction (the user must visit or be redirected to the malicious page), which blocks fully automated/worm-style spread (SSVC Automatable: no); and (2) the scope-unchanged impact - code execution is confined to the renderer sandbox (S:U), so meaningful host-level compromise requires chaining a separate sandbox-escape vulnerability. |
| Impact | Signals are moderately consistent and point to a serious-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (the victim must load a crafted HTML page). Crucially, the description states code execution occurs INSIDE the sandbox (S:U, scope unchanged) - so this alone yields renderer-level compromise, not full host takeover, which typically requires a separate sandbox-escape to chain. The decision signals temper urgency: EPSS is low at 0.20% (10th percentile), SSVC reports Exploitation: none and Automatable: no (consistent with the UI:R requirement defeating mass/worm-style automation), though Technical Impact is total. There is no CISA KEV listing and no confirmed public exploit. The vuln.today priority is 'this_week' - treat as a prompt-but-scheduled patch, not a drop-everything emergency. The low EPSS and 'Exploitation: none' are consistent with each other and with the absence of KEV, so no major conflict exists; the main caveat is that Chromium issue 572055997 is typically access-restricted, so independent technical detail beyond Google's 'High' severity rating is not available at analysis time. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a victim running an unpatched Chrome (before 156.0.8078.79) to visit it, triggering memory corruption in the Network component. Successful exploitation yields arbitrary code execution within the renderer sandbox; a full host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit code is identified at time of analysis, and the referenced Chromium bug tracker entry is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Memory corruption in Google Chrome's network component affects versions prior to 156.0.8078.79 and lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms no privileges are required but user interaction is mandatory, and scope is unchanged, so meaningful host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis: SSVC records Exploitation as none and Automatable as no, EPSS is low at 0.20% (10th percentile), and the issue is not in CISA KEV despite a total technical impact rating.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.79 or later via the Stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html and confirm the version in chrome://settings/help, restarting the browser so the update takes effect. Deployment urgency is 'this_week' per the priority signals rather than emergency, since no exploitation has been observed and EPSS is low, and updating is the complete fix identified by the vendor; the sources name no alternative workaround or feature that can be disabled to remove exposure. Interim exposure reduction is limited to standard browser hygiene consistent with the UI:R vector, namely preventing users from reaching untrusted crafted pages and keeping other Chromium-based clients on the same fixed build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-119 (improper restriction of operations within the bounds of a memory buffer) in Chrome's network component, the process that handles URL requests, HTTP parsing and network protocol handling. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with EUVD listing Chrome up to (but excluding) 156.0.8078.79 confirms all prior builds are in range. The available sources do not describe the specific trigger, the corruptible object or the exact code path; the only mechanism detail given is that a crafted HTML page is the delivery vector, and memory corruption of this class typically requires the attacker to shape heap or buffer contents before the faulty operation is reached, but the trigger specifics are not stated in the supplied evidence. Because the impact is scored S:U, any code execution stays within the renderer/network sandbox boundary rather than reaching the host directly.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N, AC:L, PR:N) requiring a user to load the page (UI:R); sandboxed code execution keeps scope unchanged (S:U) with high C/I/A within the renderer.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A high-severity memory corruption vulnerability in Google Chrome's network component affects versions prior to 156.0.8078.79, requiring a user to load a crafted HTML page. While successful exploitation could allow code execution within the browser sandbox, no public exploit has been identified and the EPSS score is low, indicating limited immediate risk to the organization. Leadership should prioritize patching to maintain a secure browsing environment and reduce potential attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB