EUVD-2026-116365
GHSA-983j-68wj-c72m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage manipulates media Track objects
-
ExecutionTrigger use-after-free (CWE-416)
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome build (prior to 157.0.8103.38) and to actively load attacker-controlled HTML content that drives the media Track object into the use-after-free state (UI:R - user interaction is required, e.g., visiting a crafted page). No authentication or special privileges are needed (PR:N). Key LIMITING factor: per the description, the arbitrary code runs only INSIDE the renderer sandbox, so full host compromise additionally requires a separate sandbox-escape vulnerability; this is why Chromium rated the severity Low despite the 8.8 base score. The precise object lifecycle and trigger steps are not described in the available sources beyond 'crafted HTML page' and the Track component. |
| Impact | Signals are mixed and should be read carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 (High) and indicates remote, unauthenticated exploitation requiring only user interaction (visiting a crafted page). However, Google/Chromium rated this flaw's security severity as Low, and the description specifies the arbitrary code executes INSIDE the sandbox (S:U, scope unchanged) - meaning a separate sandbox-escape bug would be needed to reach the host, which materially lowers real-world impact versus the raw 8.8. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or imminent exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patch-available, not-yet-exploited renderer bug. Net: real but routine Chrome patching priority - treat as 'patch this week via normal browser update cadence,' not a high-CVSS emergency. Note the explicit conflict to verify: CVSS=8.8 High vs. vendor Chromium severity=Low; the vendor rating reflects the sandbox-contained impact that the base CVSS scope metric does not fully capture. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page that manipulates media Track objects to trigger the use-after-free in Chrome's rendering engine; a victim simply visiting the page in a vulnerable Chrome build (prior to 157.0.8103.38) causes code execution within the renderer sandbox. No authentication is required but user interaction is (UI:R). No public exploit was identified in the provided data, and resulting code execution is confined to the sandbox absent a chained escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Use-after-free in Google Chrome's media Track component before 157.0.8103.38 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page (UI:R). The 8.8 base score reflects high confidentiality, integrity and availability impact, but Chromium rates the issue Low because the code execution is confined to the sandbox and full host compromise would require a separate sandbox-escape vulnerability. No public exploit was identified at time of analysis, and a vendor patch is available.
RemediationAI
Update Google Chrome to 157.0.8103.38 or later; this is the vendor-released patch referenced by the Chrome Releases stable-channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html. The fix is delivered through Chrome's standard stable-channel update mechanism, and the browser must be restarted for the new build to take effect. The available sources do not document a separate workaround beyond applying the fixed build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Track handling, part of the media Track object surface exposed to web content. A use-after-free occurs when an object is freed while a reference to it remains, and a later operation dereferences that stale reference; in this case the available sources state only that a crafted HTML page drives the media Track object into the use-after-free state, and the precise object lifecycle and trigger steps are not described beyond that. The result is memory corruption that can be shaped into arbitrary code execution inside the renderer sandbox, and the same class of corruption can also produce denial of service. The affected product is Google Chrome per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with all builds prior to 157.0.8103.38 in scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/PR:N; victim must load the page so UI:R; code stays in renderer sandbox so S:U with full in-process C/I/A High.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions before 157.0.8103.38 contain a use-after-free vulnerability that lets a remote attacker execute arbitrary code within the browser's renderer sandbox if a user visits a crafted webpage. While the sandbox limits the blast radius, a successful exploit could still lead to data exposure, session compromise, or further attacks. Leadership should prioritize patching because Chrome is widely deployed and user interaction is the only barrier to exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB