EUVD-2026-116393
GHSA-f7qw-hhhh-rh88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in GPU process
-
ExecutionReclaim freed object
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Google Chrome prior to 157.0.8103.38 to load attacker-controlled web content - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (navigating to or rendering the malicious page) is mandatory, which limits mass automation (SSVC Automatable: no). No authentication is required (PR:N). A key limiting factor is that code execution is confined to the GPU process sandbox per the vendor description, so real-world impact beyond that process requires chaining with a separate sandbox-escape vulnerability. GPU-accelerated rendering must be active for the vulnerable code path to be reached. |
| Impact | Signals are mostly aligned toward a real-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction (visiting a crafted HTML page), with total impact (C:H/I:H/A:H), yielding 8.8. Critically, the description qualifies that arbitrary code executes 'inside the sandbox' - i.e. within the GPU process - not a full sandbox escape, so real-world impact is bounded unless chained with a second bug. SSVC reinforces lower urgency: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (user interaction defeats mass automation), though Technical Impact is 'total'. There is no CISA KEV listing and no public PoC or working exploit identified; the chromium issue tracker reference (issues.chromium.org/569129173) is almost certainly access-restricted and is not verified working exploit code. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored. The vuln.today Decision label is 'this_week', consistent with a patched, high-severity browser memory-corruption bug that is not yet exploited. Net: a genuine high-severity issue warranting prompt patching on Chrome's normal cadence, not an act-now emergency given no exploitation evidence and sandbox-confined impact. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted content that triggers the GPU-process use-after-free when a victim using a pre-157.0.8103.38 Chrome browser visits it. Successful exploitation lets the attacker run arbitrary code within the GPU process sandbox; no public exploit code has been identified, and full compromise would require chaining this with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Remote code execution inside the GPU process sandbox in Google Chrome before 157.0.8103.38 allows a remote attacker to run arbitrary code when a victim loads a crafted HTML page, with user interaction required (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Impact beyond the GPU sandbox would require chaining with a separate sandbox-escape vulnerability, and SSVC records Exploitation: none and Automatable: no. A vendor patch is available in 157.0.8103.38; no active exploitation or public exploit was identified at time of analysis, and the priority decision is this_week.
RemediationAI
Update Google Chrome to 157.0.8103.38 or later; this is the vendor-released patch version. Apply the update through normal Chrome desktop update channels and restart the browser so the fixed build is running, using the Stable Channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html for deployment details. The supplied sources do not describe a workaround or validated compensating control short of updating, so environments that cannot update immediately should treat the this_week priority as requiring expedited rollout of 157.0.8103.38.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Use-after-free (CWE-416) is a memory-safety class in which an object is freed while references to it remain, so later use of the dangling pointer can corrupt memory and, in this Chrome GPU component, permit arbitrary code execution inside the GPU process sandbox. The vulnerable path is reached through GPU-accelerated rendering of attacker-controlled HTML, and the supplied assessment notes that GPU acceleration must be active. The CVSS vector specifies network reachability, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality/integrity/availability impact; the vendor description confines code execution to the GPU process sandbox, so browser-wide or OS-level compromise is not established without an additional sandbox escape. SSVC lists Exploitation: none, Automatable: no, and Technical Impact: total, while the supplied tags classify the issue as RCE, denial of service, use-after-free, and memory corruption. The available sources do not describe the specific GPU object or lifetime operation that triggers the use-after-free.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (AV:N/AC:L/PR:N/UI:R); scope unchanged as code stays in the GPU process, with total impact within it.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity remote code execution vulnerability in the GPU process sandbox. A user must visit a malicious webpage for exploitation to occur, potentially allowing an attacker to run arbitrary code within the sandbox, though full system compromise would require an additional sandbox escape. Given Chrome's widespread use across the organization, unpatched browsers represent a significant risk to endpoint integrity and data confidentiality.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB