EUVD-2026-116304
GHSA-8p8c-7vrw-2h2v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Scheduling
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 157.0.8103.38 to load attacker-controlled web content - i.e., the user must navigate to or render a crafted HTML page (UI:R), which is the primary limiting factor. No authentication and no non-default configuration are required (PR:N; applies to default Chrome installs). The key impact limiter is that arbitrary code execution is contained within the renderer sandbox (S:U, 'inside the sandbox'); escaping to the host OS would require an additional, separate sandbox-escape vulnerability not covered by this CVE. Platform scope follows the affected desktop Chrome stable channel. |
| Impact | Signals are mixed and point to an elevated-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction. Crucially, the description states code execution occurs 'inside the sandbox' with S:U (no scope change), so the immediate impact is confined to the Chromium renderer process rather than the host OS - a point the raw 8.8 score does not convey. KEV status is not indicated in the input, so there is no confirmation of active exploitation. No EPSS score was provided, and no POC/exploit-code entry is listed (the issues.chromium.org link is a vendor bug-tracker reference, which is typically access-restricted and is not verified working exploit code). Google rated the Chromium security severity as Medium, which is lower than the 8.8 NVD-style figure and reflects the sandbox-contained impact. The vuln.today decision label is 'this_week', consistent with a patched browser memory-corruption bug that is worth prompt patching but is not flagged for immediate emergency action. Net: a real, patch-worthy renderer RCE, but absent a sandbox-escape chain, KEV listing, or EPSS data, it reads as a standard high-priority Chrome update rather than a confirmed widespread-exploitation emergency. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's Scheduling component. A victim running a vulnerable Chrome build (before 157.0.8103.38) merely visits the page, and the attacker gains arbitrary code execution within the renderer sandbox. No authentication is required, but the victim must navigate to the malicious page; achieving full host compromise would require chaining this with a separate sandbox-escape vulnerability, and no public exploit is listed in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
A use-after-free memory-corruption flaw (CWE-416) in Google Chrome's Scheduling component allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 157.0.8103.38. The only real barrier is user interaction (UI:R) - no credentials or non-default configuration are needed - and because the impact is contained 'inside the sandbox', full host compromise would require a second, separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but with a CVSS v3.1 base score of 8.8 against a Chromium-assigned severity of Medium and a vendor fix already shipping, signals are mixed and point to an elevated-but-not-emergency priority (this_week).
RemediationAI
Vendor-released patch: Google Chrome 157.0.8103.38, published in the November 2026 stable-channel update (https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html). Upgrade every Chrome installation to 157.0.8103.38 or later, confirm the build via chrome://version, and fully restart the browser so the new binary replaces already-running renderer processes; the built-in updater normally applies this automatically, but managed fleets should push and verify the version through their update tooling rather than waiting on auto-update. Because exploitation requires the victim to render a crafted HTML page, environments that cannot immediately patch should treat untrusted web browsing as the exposure surface and prioritize the update on endpoints used for general internet access. No alternative mitigation, workaround or configuration change is documented in the available advisory material, and no patch bypass or exploitation activity has been reported at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chrome renders untrusted web content in a separate, sandboxed renderer process; a use-after-free in the Scheduling component means an object associated with task/scheduling bookkeeping can be freed while a dangling reference remains, and the crafted HTML page then drives reuse of that freed memory. Successful reuse in the renderer gives an attacker control over memory the process still treats as valid, which is the classic route to arbitrary code execution - here explicitly scoped to the renderer sandbox (S:U). The CVSS vector AV:N/AC:L/PR:N/UI:R indicates the attack is delivered over the network with no privileges and no special conditions, gated only by the victim rendering attacker-supplied content. CWE-416 is a memory-safety class that frequently yields both code execution and denial-of-service outcomes, consistent with the RCE, Denial Of Service, Use After Free and Memory Corruption tags attached to this record. The precise allocation/free sequence and the specific Scheduling code path are not described in the available sources; technical detail is tracked in the linked Chromium issue (issues.chromium.org/issues/568988525).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to open it (UI:R); code exec stays in the renderer so scope is unchanged (S:U) with high renderer-process C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity memory corruption flaw that could let an attacker execute code within the browser's sandbox when a user visits a malicious webpage. While sandbox isolation limits host compromise, the broad deployment of Chrome across the organization means a successful attack could lead to data theft or further intrusion, making timely patching essential to protect users and sensitive information.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB