EUVD-2026-113431
GHSA-6cxq-rcmw-8hwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitServe malicious V8 JavaScript
-
ExecutionTrigger improper input validation in V8
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to use an unpatched Google Chrome build prior to 156.0.8078.79 and to visit a crafted/attacker-controlled HTML page (UI:R - user interaction required, consistent with a web-content attack). No authentication is required (PR:N). A key limiting factor is scope: the description explicitly states code execution occurs 'inside the sandbox' (S:U), so a successful exploit is contained within the renderer process and would require chaining a separate sandbox-escape vulnerability to compromise the underlying host. No special non-default Chrome configuration is indicated as necessary. |
| Impact | Signals are consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a remote, low-complexity, unauthenticated attack that requires user interaction (visiting a crafted HTML page) and yields high confidentiality, integrity, and availability impact. Crucially, the description states code execution occurs 'inside the sandbox' (scope S:U), so this is NOT by itself a full host compromise - it would need to be chained with a sandbox-escape bug to achieve persistent system-level control. KEV is not listed and SSVC Exploitation is 'none', so there is no evidence of active exploitation; EPSS is low at 0.24% (15th percentile), consistent with the absence of observed exploitation. SSVC Technical Impact is 'total' but Automatable is 'no' (user interaction is required), which tempers mass-exploitation risk. The vuln.today Decision label is 'this_week', reflecting a high-severity browser RCE with an available patch that should be deployed promptly but is not flagged as act_now/emergency. Net: a genuine high-priority patch item for any Chrome fleet, but current real-world exploitation risk is moderate rather than urgent, and the sandbox containment is a meaningful mitigating factor. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that abuses the V8 input-validation flaw; a victim using an unpatched Chrome (prior to 156.0.8078.79) simply visits the page and the attacker achieves code execution within the renderer sandbox. No public exploit code was identified at time of analysis, and the specific trigger is not described in the available sources. Real-world impact beyond the sandbox would require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Arbitrary code execution inside the renderer sandbox is possible in Google Chrome builds prior to 156.0.8078.79, where improper input validation in the V8 engine lets a crafted HTML page drive the engine into executing attacker-influenced code. The attack is network-delivered and needs no credentials, but requires the victim to open attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and scope is unchanged - the payload runs inside the sandbox rather than on the underlying host. No exploitation has been observed per SSVC (Exploitation: none), no public exploit was identified at time of analysis, EPSS is 0.24% (15th percentile), and the vendor has shipped a fixed build (156.0.8078.79).
RemediationAI
Vendor-released patch: 156.0.8078.79 - update Google Chrome to that build or later through the stable channel; the release notes are at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html and the fix is tracked at https://issues.chromium.org/issues/574660146 (Chrome's update mechanism applies the new build when the browser is relaunched). The supplied sources do not describe any workaround or configuration-level mitigation beyond applying the update, and because the flaw is reached through ordinary web content, none of the provided data identifies a feature that can be disabled to remove exposure. Given that SSVC records no observed exploitation and EPSS is low at 0.24% (15th percentile), the update fits a this-week remediation cadence rather than emergency response, while noting that a successful exploit is contained only by the renderer sandbox and would need to be chained with a separate sandbox escape to affect the host.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is the JavaScript and WebAssembly engine embedded in Google Chrome, and CWE-20 (Improper Input Validation) indicates that attacker-supplied input reaching the engine is not validated before use, which the Chromium severity rating (High) treats as exploitable for code execution in the renderer. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected component is the Chrome browser itself rather than a standalone V8 distribution, and the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable flaw requiring user interaction, with High confidentiality, integrity and availability impact but no scope change - consistent with the description that execution stays inside the sandbox, so reaching the host would require chaining a separate sandbox-escape issue. The precise malformed construct that triggers the flaw is not described in the available sources beyond the crafted HTML page vector, and SSVC records Automatable: no, so large-scale automated exploitation is not indicated by the current intelligence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote web-content attack with no privileges but requiring the victim to load a page (UI:R); execution is confined to the sandbox so scope is unchanged (S:U) with high C/I/A within that process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 156.0.8078.79 contain a high-severity flaw in the V8 JavaScript engine that allows remote code execution within the browser sandbox when a user visits a malicious webpage. Although no active exploitation has been observed, the widespread use of Chrome across the organization means that a single user visit to a compromised site could lead to unauthorized code execution, potentially resulting in data theft or further network compromise. Leadership should prioritize patching to maintain the integrity of the browsing environment and reduce exposure to future threats.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB