EUVD-2026-113428
GHSA-h33g-hwp9-mfhw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryBrowser renders malicious input content
-
ExploitTrigger use-after-free in Input component
-
ExecutionExecute arbitrary code inside renderer sandbox
-
ImpactSandboxed code execution on victim host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using a vulnerable Chrome build (prior to 156.0.8078.79) to open or render a crafted HTML page - user interaction is mandatory (CVSS UI:R), so the attacker must drive the victim to attacker-controlled content (malicious site, injected/compromised page, or malvertising). No authentication or special configuration is needed; default Chrome configurations are affected (PR:N). The key limiting factor beyond user interaction is that the description states code executes 'inside the sandbox': this is renderer-level code execution, not a confirmed sandbox escape, so impact on the host is bounded unless chained with an additional sandbox-escape vulnerability. The precise trigger mechanism within the Input component is not detailed in the available sources. |
| Impact | Signals are moderate and largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, with high confidentiality, integrity and availability impact but no scope change - consistent with a use-after-free (CWE-416) reached by rendering a crafted HTML page. Critically, the description states code executes 'inside the sandbox,' so this is not a confirmed sandbox escape and real-world impact is constrained by Chrome's renderer sandbox absent a separate escape. Exploitation signals are low: EPSS is 0.24% (15th percentile), SSVC reports Exploitation: none and Automatable: no (though Technical Impact: total), and the vulnerability is not in CISA KEV. These low exploitation probabilities contrast with the high technical severity, indicating a serious memory-corruption bug that is not yet seeing observed exploitation. The vuln.today 'this_week' priority reflects a patch-promptly posture rather than an emergency. Net: a genuine high-severity browser RCE to patch on a normal urgent cadence, not a drop-everything incident, but UAF bugs of this class are historically attractive targets so the window should not be left open. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page (e.g. via a malicious site, malvertising, or a compromised page) and lures a victim running a vulnerable Chrome build to open it. Rendering the page triggers the use-after-free in the Input component, letting the attacker execute arbitrary code within the renderer sandbox; full host compromise would require a separate sandbox-escape bug. No public, verified working exploit code is identified in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Heap use-after-free in Google Chrome's Input component allows a remote attacker to execute arbitrary code inside the sandbox if a victim opens a crafted HTML page in any Chrome build prior to 156.0.8078.79. User interaction is mandatory (CVSS UI:R) and no authentication or non-default configuration is needed, so the realistic delivery path is a malicious or compromised site, injected page content, or malvertising; because the flaw yields renderer-level execution described as 'inside the sandbox', host impact is bounded absent a separate sandbox escape. Exploitation is not confirmed in the wild (SSVC exploitation: none, EPSS 0.24%, 15th percentile), but the vendor-rated Chromium severity is High with a total technical impact score, and a fixed build is already published.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.79 or later, as published in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html. Because exploitation requires only that a victim render a crafted HTML page, treat the update as time-sensitive: force a relaunch so the new build takes effect, verify the installed version on managed endpoints, and prioritize browsers used for general web browsing and any profile that opens untrusted links. Until the upgrade is deployed, the available compensating controls are limited and carry trade-offs: restricting browsing to an allowlist of trusted sites reduces exposure to malvertising and attacker-hosted pages but breaks general web use, and running untrusted content in a separate hardened or disposable browser profile limits blast radius but does not eliminate the renderer-level compromise itself. Note that because code execution is described as occurring inside the sandbox, a compromised renderer is contained at the process level but same-origin data visible to that renderer should still be considered exposed; updating to 156.0.8078.79 is the complete fix per the vendor advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free, a memory-safety class in which a heap object is freed while a reference to it remains reachable, so later use of that stale pointer can be redirected through attacker-influenced heap contents into arbitrary code execution. Here the dangling reference lives in Chrome's Input component, the subsystem handling user input plumbing in the renderer; the published sources do not describe the precise trigger sequence, only that a crafted HTML page is sufficient. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and the EUVD record identify all Chrome builds below 156.0.8078.79 as affected. Critically, the resulting execution is described as occurring inside the sandbox: this is renderer compromise, not a demonstrated containment escape, so on its own it does not grant host-level access and would need chaining with a sandbox-escape bug to reach the operating system. Chromium's site isolation and renderer sandbox limit what the compromised process can touch, though same-origin data in that renderer remains exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted HTML page is network-delivered and low-complexity (AV:N/AC:L), needs no auth (PR:N) but requires the victim to open it (UI:R); code runs in the sandbox with no scope change (S:U) yielding high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 156.0.8078.79 contain a high-severity memory corruption vulnerability (CVE-2026-76031) that could let a remote attacker execute code within the browser sandbox if a user visits a specially crafted webpage. This affects all employees using unpatched Chrome, exposing the organization to potential malware delivery via malicious or compromised websites, though impact is currently limited to the browser sandbox and no active exploitation has been observed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB