EUVD-2026-116309
GHSA-74vh-4vjm-8m3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Source
-
ExecutionReclaim freed object with controlled data
-
ImpactGain code execution in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in Chrome - a crafted HTML page served directly or embedded via a malicious iframe/ad (UI:R, user interaction required). No authentication or special privileges are needed (PR:N) and default configurations are affected. The key limiting factor is that the resulting code execution is confined to the renderer sandbox: this flaw alone does not compromise the host operating system, and escaping the sandbox would require chaining an additional, separate vulnerability. Applies to desktop Chrome builds prior to 157.0.8103.38. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) describes a remotely reachable, low-complexity, unauthenticated memory-corruption flaw that requires one user action - visiting a page. Two signals pull against each other: NVD-style scoring rates this 8.8 High, while Google's own Chromium severity is Medium, and the description is explicit that code executes 'inside the sandbox,' meaning this is a renderer-level use-after-free rather than a full host compromise; on its own it does not escape Chrome's sandbox and would need to be chained with a separate sandbox-escape bug to fully take over a machine. EPSS is not provided, the CVE is not listed in CISA KEV, and no confirmed working exploit is referenced (the chromium issue tracker link is a restricted bug entry, not a published PoC), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week,' consistent with a High-scored but non-emergency browser bug: patch promptly on the normal browser-update cadence rather than as an active-exploitation emergency. Net: a real, broadly-reachable browser vulnerability whose practical impact is bounded by the sandbox and by the requirement that the victim open a malicious page. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page (or injects it via a malicious ad/iframe) and lures a victim running a vulnerable Chrome build to open it. The page triggers the use-after-free in the Source component, giving the attacker arbitrary code execution within the renderer sandbox. No public exploit is identified at time of analysis, and full host compromise would require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Use-after-free in Google Chrome before 157.0.8103.38 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) confirming that only user interaction is required. The impact is bounded by Chrome's sandbox: this flaw alone does not compromise the host operating system, and escaping the sandbox would require chaining a separate vulnerability. A vendor patch is available, and no public exploit has been identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 157.0.8103.38 or later; this is the vendor-released patch. Use the stable-channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html and the Chromium issue at https://issues.chromium.org/issues/569659190 for release details. Until the update is applied, the renderer sandbox limits this flaw's impact to code execution inside the sandbox rather than the host OS, but that is not a substitute for patching; no other workaround or mitigation is specified in the available sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a memory-safety defect in Google Chrome's Source component, classified CWE-416 (use after free): a freed object is reused in a way that can corrupt memory and let an attacker execute arbitrary code within the affected renderer process. Chrome's multi-process architecture confines that code execution to the renderer sandbox, so host compromise requires a separate sandbox escape; the CVE's CVSS scope remains unchanged (S:U). The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD-2026-116309 version data point to Chrome builds before 157.0.8103.38, and Chromium rated the issue Medium even though the CVSS base score is 8.8 High. The specific trigger beyond loading a crafted HTML page is not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but requires the victim to open it (UI:R); scope unchanged (S:U) as code stays within the sandboxed renderer.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity vulnerability that allows a remote attacker to execute arbitrary code within the browser's sandbox when a user visits a malicious webpage. This puts all employees who use Chrome for web browsing at risk, though the sandbox limits the impact to the browser process, preventing full system compromise unless combined with another flaw. Leadership should prioritize patching to maintain endpoint security and prevent potential data breaches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB