EUVD-2026-116522
GHSA-vhv9-fr7j-589q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in PerformanceAPIs
-
ExecutionReclaim freed object to corrupt memory
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 157.0.8103.38 to load attacker-controlled content that exercises the PerformanceAPIs code path - i.e. the victim must visit or be redirected to a crafted HTML page (UI:R, passive user interaction). No authentication or elevated privileges are needed (PR:N). The key LIMITING factors are: (1) user interaction is mandatory - there is no zero-click vector; (2) the resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability is required to compromise the host OS; and (3) only unpatched versions (<157.0.8103.38) are affected, so the fix fully closes the issue. The precise object-lifecycle trigger within PerformanceAPIs is not described in the available sources. |
| Impact | This is a genuine priority, not a high-CVSS-but-low-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a user visit a crafted HTML page - the standard and highly realistic drive-by model for a browser engine bug. The CWE-416 use-after-free in PerformanceAPIs is the memory-corruption primitive Chromium renderer exploits are routinely built from. Two signals temper raw severity: first, the description states code executes INSIDE the sandbox (S:U, no scope change), so a separate sandbox-escape chain is still needed for full host compromise - the renderer-level impact is real but not by itself a complete system takeover. Second, key escalation signals are absent from the input: no CISA KEV listing, no EPSS probability, and no confirmed public exploit, so there is no evidence of active or imminent widespread exploitation at time of analysis. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a patched, not-yet-exploited high-severity browser bug. Net: patch promptly (within the week per the decision label) given ubiquity and low attack complexity, but there is no data indicating emergency in-the-wild exploitation. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's PerformanceAPIs; when a victim simply visits the page, the freed object is reclaimed and reused to corrupt memory, letting the attacker execute arbitrary code within the renderer sandbox. The low attack complexity (AC:L) and need only for passive user interaction (UI:R) make this a classic drive-by scenario, though code runs inside the sandbox and would require a further escape for full system control. No public exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Use-after-free in Chrome's PerformanceAPIs lets a remote attacker who gets a victim to open a crafted HTML page execute arbitrary code inside the renderer sandbox on versions prior to 157.0.8103.38. Exploitation requires the user to load attacker-controlled content (UI:R) but no credentials or privileges (PR:N), and any code execution stays confined to the renderer until a separate sandbox escape is chained; the issue is rated High by Chromium and carries an 8.8 CVSS. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the vendor fix should be applied on this week's patch cycle given the memory-corruption RCE class and broad desktop install base.
RemediationAI
Upgrade Google Chrome to 157.0.8103.38 or later; that build is the vendor-released fix and closes the PerformanceAPIs use-after-free, so patched installations are no longer affected. The patch is documented in the November stable channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html, with technical detail at https://issues.chromium.org/issues/566506819, and should be rolled out through normal Chrome auto-update or an enterprise update policy with a version check confirming 157.0.8103.38 is installed. The supplied intelligence does not identify a feature toggle, flag or configuration workaround for this code path, so no specific compensating control is documented; where immediate updating is not possible, note that exploitation requires the victim to load crafted HTML in an unpatched browser and that resulting code execution is limited to the renderer sandbox, which reduces but does not remove risk since a chained sandbox escape would escalate to the host. Because the decision label is this_week and the issue is a High-severity memory-corruption RCE in a widely deployed browser, schedule the update within the current patch cycle rather than deferring it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in the PerformanceAPIs surface of Chrome's Blink renderer, the timing and performance-observation APIs exposed to web content. A use-after-free means an object is released while a live reference remains, so subsequent access reads or writes freed memory; in a browser renderer this typically yields heap corruption that an attacker can steer toward controlled code execution inside the sandboxed renderer process. The affected component is the general Chrome browser package (cpe:2.3:a:google:chrome), and per EUVD the impacted range is builds earlier than 157.0.8103.38. The exact object lifecycle and sequence of PerformanceAPIs calls that triggers the free-and-reuse is not described in the available sources, and the supplied evidence does not specify which platforms or which of the multiple PerformanceAPIs entry points are involved. Because the vector is AV:N/AC:L/PR:N/UI:R, the realistic path is a malicious or compromised page that the victim visits or is redirected to, with the attacker gaining renderer-level code execution rather than host compromise unless a second sandbox-escape bug is chained.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remotely reachable via a crafted web page with low complexity and no privileges (AV:N/AC:L/PR:N); a page visit is required (UI:R); code runs inside the sandbox with no scope change (S:U) but full renderer-context C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity use-after-free vulnerability in PerformanceAPIs, enabling remote code execution within the renderer sandbox when a user visits a malicious webpage. This puts all organizational users of unpatched Chrome at risk, though exploitation requires user interaction and successful code execution remains confined to the sandbox until an additional exploit is chained. Given the broad desktop install base and memory-corruption nature, leadership should prioritize this for immediate remediation to prevent potential credential theft or data exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB