EUVD-2026-116527
GHSA-3xqh-478q-m8cr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malformed media content
-
ExploitTrigger heap buffer overflow in Media component
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or be redirected to an attacker-controlled web page containing crafted media content (UI:R) using Google Chrome prior to 157.0.8103.38; no authentication or pre-existing access is needed (PR:N). The primary limiting factors are the mandatory user interaction (the user must load the malicious page) and the sandbox boundary: per the description, resulting code execution is confined to the sandbox, so additional exploitation (a sandbox escape) is required to compromise the underlying host. Updating to 157.0.8103.38 or later is the vendor-provided fix. |
| Impact | This is a genuine high-priority browser flaw, but the signals are mixed rather than screaming emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remote, low-complexity, unauthenticated (PR:N) code-execution bug that requires one piece of user interaction (UI:R) - the victim visiting a crafted HTML page. Crucially, the description states the arbitrary code executes INSIDE the sandbox (reflected in S:U, scope unchanged), so a separate sandbox-escape would be needed for full host compromise; raw 8.8 therefore overstates the immediate blast radius on a default, sandboxed Chrome install. The SSVC framework reports Exploitation: none and Automatable: no, with Technical Impact: total - consistent with a serious memory-corruption primitive that is not yet observed being exploited and not trivially wormable (user must be lured to a page). There is no CISA KEV listing and no EPSS score supplied, so probability-of-exploitation cannot be quantified from this data. The vuln.today decision label is 'this_week', i.e. patch promptly but not an out-of-cycle emergency. Net: a real, must-patch issue for any Chrome fleet, driven by ubiquity and total technical impact, but current evidence shows no active exploitation and a sandbox-bounded impact, placing it below drop-everything KEV-grade flaws. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing media content crafted to trigger the heap buffer overflow in Chrome's Media component, then lures a victim to open it (UI:R). When the page loads, the overflow corrupts heap memory and achieves arbitrary code execution within the renderer sandbox. No public, verified working exploit was identified at the time of analysis; a Chromium issue-tracker reference exists but is not confirmed exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Heap-based buffer overflow in Google Chrome's media handling lets a remote attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, affecting every Chrome build prior to 157.0.8103.38. The flaw carries an 8.8 CVSS score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are needed but the user must be lured to the malicious page; the resulting code execution is confined to the sandbox, so host compromise would require a separate sandbox escape. No public exploit code has been identified at time of analysis and SSVC records exploitation as none, though CISA's framework rates technical impact as total; vendor-released patch 157.0.8103.38 is available and the item is prioritized for remediation this week.
RemediationAI
Upgrade Google Chrome to 157.0.8103.38 or later, which is the vendor-released patch listed for this CVE; the fix ships through Chrome's standard update channel, so verify the browser version on each endpoint and force a relaunch, since pending updates only apply after the browser restarts. Enterprise fleets managed by policy should push version 157.0.8103.38 through their update mechanism and confirm compliance, paying particular attention to long-lived sessions and kiosk or remote-workforce devices that may not have restarted recently. The authoritative vendor advisory is https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html, and the Chromium issue https://issues.chromium.org/issues/567936265 can be consulted for fix details. No alternative workaround is documented in the available sources, and given that the flaw is reached simply by rendering a crafted page, updating is the practical control; note that the described code execution is contained by the browser sandbox, so keeping site isolation and the sandbox enabled preserves that boundary for any unpatched hosts still in service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-122, a heap-based buffer overflow, which in this case lives in Chrome's Media component - the Chromium code path that parses and decodes audio and video content delivered by web pages. A heap overflow of this class means a size or bounds calculation on a heap-allocated buffer is not enforced before data is written, allowing adjacent memory to be corrupted; the exact parsing routine at fault is not described in the available sources beyond the fact that crafted media content triggers it. Because the flaw sits in the renderer-side media pipeline, successful corruption yields code execution within the renderer's sandbox rather than on the host, which is why the assessed impact stops at sandbox-level RCE. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) with no platform or version qualifiers indicates all desktop and mobile Chrome builds below 157.0.8103.38 are in scope, and EUVD lists the affected range as versions earlier than 157.0.8103.38. Chromium's own security severity for this entry is High, matching the 8.8 CVSS base score.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must visit it (UI:R); code runs inside the sandbox so scope is unchanged (S:U) with total impact in that context.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity heap buffer overflow that allows code execution within the browser sandbox when a user visits a malicious webpage. This affects all employees using Chrome for work, but exploitation requires user interaction and is confined to the sandbox, limiting host compromise without an additional escape. Leadership should prioritize patching to prevent potential data exposure and operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB