EUVD-2026-116519
GHSA-rc99-6qwq-f3vq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malformed media in HTML
-
ExecutionTrigger heap buffer overflow in Media
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in Chrome - a crafted HTML page delivering malformed media to the Media component - matching CVSS UI:R; it cannot be triggered without user interaction. It affects default configurations of Chrome prior to 157.0.8103.38 with no authentication or special privileges (PR:N) and no non-default settings called out in the advisory. A key limiting factor is that the resulting code execution is confined to Chrome's renderer sandbox per the description, so full host compromise would additionally require a separate sandbox-escape vulnerability; updating to 157.0.8103.38 or later is the vendor's fix. |
| Impact | This is a genuine priority for any environment running Chrome, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) indicates a network-reachable, low-complexity flaw needing no privileges but requiring user interaction - the victim must load a crafted HTML page. CISA SSVC signals temper raw severity: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no' (user interaction breaks mass-scale automation), while Technical Impact is 'total,' consistent with arbitrary code execution. The vuln.today decision label is 'this_week,' aligning with a patch-promptly rather than patch-now posture. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified here. Not in CISA KEV and no confirmed public exploit. One important scoping nuance: the description states code executes 'inside the sandbox,' so by itself this does not grant host compromise - a separate sandbox-escape chain would be required for full system takeover, which the CVSS C:H/I:H/A:H reflects at the renderer/sandbox level with Scope:Unchanged. Signals are internally consistent (no KEV, no POC, Exploitation:none, this_week), pointing to a real but not actively-exploited high-severity browser bug. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malformed media content and lures a Chrome user (via link, ad, or injected iframe) to visit it. When Chrome's media component parses the crafted data, a heap buffer overflow is triggered, allowing the attacker to execute arbitrary code within the browser's sandboxed renderer process. No public exploit was identified at time of analysis, and user interaction (loading the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Heap buffer overflow in Google Chrome's Media component before 157.0.8103.38 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) with attacker-supplied content and no authentication or special privileges (PR:N), and the resulting code execution stays contained within Chrome's sandbox, so full host compromise would need a separate sandbox-escape flaw. There is no CISA KEV entry and no public exploit identified at time of analysis, and Google has released the fix in Chrome 157.0.8103.38, making this a patch-this-week item rather than an emergency for environments running affected Chrome builds.
RemediationAI
Vendor-released patch: Chrome 157.0.8103.38 or later. Update Google Chrome through the browser's built-in updater (or force the version via your enterprise update policy) and confirm the reported version is at least 157.0.8103.38; the release notes are at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html. Chromium rates this High and the internal priority is to patch this week, so treat the upgrade as a scheduled near-term action rather than a drop-everything emergency. Until the update is deployed, the practical exposure reduction comes from the fact that triggering requires a victim to load a crafted HTML page, so limiting browsing of untrusted content on unpatched builds lowers the chance of exploitation; note this is only a reduction in exposure and not a substitute for the vendor fix, which is the only complete remediation identified in the available sources. No non-default configuration workaround is documented for this issue, and because the code execution is confined to the renderer sandbox, an unpatched browser remains exploitable for in-sandbox code execution even with a hardened configuration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-122 heap-based buffer overflow in Chrome's Media component, the code path responsible for parsing and decoding media streams delivered by web pages. Because the overflow is heap-based, the root cause is insufficient bounds validation on attacker-influenced media data, which can corrupt adjacent heap memory and, per the Chromium severity rating (High), be turned into arbitrary code execution. The attack surface is the browser's default media handling: the victim only has to open a crafted HTML page that delivers malformed media, which matches the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and the user-interaction requirement. Importantly, the advisory scopes the impact to code execution inside the sandbox, meaning the primitive is constrained to the renderer/media process; escaping to the host operating system would require chaining an independent sandbox-escape vulnerability. Affected builds are identified by CPE cpe:2.3:a:google:chrome and by Chromium issue 566251701; no non-default configuration or special privilege is called out, so standard desktop Chrome deployments prior to 157.0.8103.38 are in scope. The exact trigger conditions beyond 'crafted HTML page delivering malformed media' are not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted HTML needs the user to load a page (UI:R) with no auth (PR:N); impact is code execution confined to the renderer sandbox, so Scope stays Unchanged with high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A high-severity heap overflow in Google Chrome's Media component (CVE-2026-121047) could let a remote attacker run code within the browser sandbox when a user visits a malicious web page. Because Chrome is widely deployed across the workforce, the primary organizational risk is targeted compromise of employee endpoints, though the sandbox limits blast radius and no active exploitation is currently known. Leadership should prioritize rapid patching to reduce exposure to future exploit development.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB