EUVD-2026-91714
GHSA-xfgv-72w2-fx82
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
DeliveryServe crafted HTML/JavaScript
-
ExploitTrigger MediaStream use-after-free
-
ExecutionReuse freed object to corrupt memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use the WebRTC/MediaStream capability path in Chrome and to visit or render an attacker-controlled page containing the crafted HTML/JavaScript - this user interaction (UI:R) is the primary limiting factor; there is no authentication requirement (PR:N). The resulting code execution is confined to the renderer sandbox (S:U, 'inside the sandbox' per the description), so reaching the host OS would require an additional, separate sandbox-escape vulnerability not covered by this CVE. Affects Chrome builds prior to 154.0.8037.97; updating to 154.0.8037.97 or later removes the condition. |
| Impact | Signals here are mixed and point to a serious-but-not-emergency priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that only requires a user to visit a page - classic drive-by browser risk. However, two factors temper the raw score: (1) the description explicitly states code execution occurs 'inside the sandbox,' meaning this is a renderer-process compromise, not full host takeover - a sandbox escape would be needed to reach the OS, and none is mentioned; and (2) exploitation signals are weak - EPSS is only 0.21% (11th percentile), the CVE is NOT in CISA KEV, and SSVC records Exploitation: none and Automatable: no. The SSVC 'Technical Impact: total' refers to total control of the vulnerable (sandboxed) component, consistent with an arbitrary-code-execution UAF, and should not be read as total host compromise. No POC is referenced. Net: a legitimately high-severity memory-corruption bug in a ubiquitous product with a patch already available, but current evidence shows no active or automatable exploitation, so it is a 'patch promptly on the normal browser-update cadence' item rather than a drop-everything KEV-grade emergency. Note the 'Denial Of Service' tag is plausible (UAFs can crash the renderer) but the primary impact is RCE-in-sandbox; treat DoS as secondary. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects a malicious ad/iframe into a site a victim trusts) containing JavaScript that manipulates MediaStream objects to trigger the use-after-free. When the victim browses to the page with a vulnerable Chrome build (<154.0.8037.97), the freed object is reclaimed and reused to corrupt memory, letting the attacker execute arbitrary code within the renderer sandbox. No public exploit is identified at time of analysis, and full host compromise would additionally require a separate sandbox-escape chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Use-after-free in Google Chrome's MediaStream component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, affecting all Chrome builds prior to 154.0.8037.97 on the stable channel. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but depends on user interaction: the target must load a malicious page that exercises the WebRTC/MediaStream path, and the resulting code execution is confined to the sandboxed renderer (S:U), so host-level compromise would require a separate sandbox-escape bug. At time of analysis there is no public exploit identified and no evidence of active exploitation (SSVC Exploitation: none, EPSS 0.21% / 11th percentile), while a vendor patch exists at Chrome 154.0.8037.97, making this a serious-but-not-emergency patching priority.
RemediationAI
Vendor-released patch: Google Chrome 154.0.8037.97. Update by allowing Chrome's auto-update mechanism to install the 154.0.8037.97 stable release (or later), then fully restart the browser so the new renderer process is loaded; confirm the running build on chrome://version, and push the update through enterprise management (e.g., Chrome Browser Cloud Management, or your software-deployment/OS patch pipeline) rather than relying on end users. Details are in the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html, and the upstream defect is tracked at https://issues.chromium.org/issues/565742180. Because the impact is contained to the sandboxed renderer (S:U) and there is no public exploit identified (EPSS 0.21%, SSVC Exploitation: none), no emergency workaround is warranted; if immediate patching of a specific high-value host is impossible, reduce exposure by restricting that host's browsing to trusted origins and blocking rendering of untrusted HTML/JavaScript until the update lands - but note this is disruptive and breaks most web applications, so it is a stopgap, not a substitute for 154.0.8037.97. Keeping Site Isolation enabled and running the browser with the OS-level sandbox intact is recommended, since those controls are what keep a renderer memory-corruption primitive from translating into host compromise, though they do not remediate the use-after-free itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in Chrome's MediaStream implementation, the WebRTC/Blink layer that handles audio and video capture streams, getUserMedia-style negotiation, and the associated media track objects rendered on a page. In this bug class, an object backing a media stream or track is freed while a reference (pointer) to it is still retained; when the stale pointer is later dereferenced, the attacker-influenced content of the reallocated heap region can be interpreted as legitimate object data, leading to memory corruption and attacker-controlled control flow within the renderer process. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* uses a wildcard version, reflecting that the defect is present in every Chrome build before 154.0.8037.97 rather than in a narrow version band; EUVD-2026-91714 records the same boundary. Chromium's security severity for this issue is High, and the accompanying tags (RCE, memory corruption, use after free, denial of service) are consistent with a heap-corruption primitive that can be steered toward code execution but may also crash the renderer. Because the flaw lives in the renderer's media pipeline and Chrome enforces process sandboxing, successful exploitation grants code execution only inside the sandbox (S:U per the assessed vector); the Chromium issue tracker entry at issues.chromium.org/issues/565742180 is the upstream record, and the stable-channel release note at chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html documents the fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N), no privileges (PR:N) but victim must load the page (UI:R); UAF yields full renderer control (C/I/A:H) confined to the sandbox, so scope unchanged (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A memory-safety flaw in Google Chrome's MediaStream (WebRTC) component allows a remote attacker to run code inside the browser sandbox when a user merely loads a crafted web page, meaning every unpatched Chrome installation on our endpoints represents an available attack surface. The affected population is effectively everyone who browses the web with Chrome, although the malicious code is contained within the sandboxed renderer unless the attacker also holds a separate sandbox-escape exploit, and at time of analysis no public exploit code or active exploitation has been identified. Because the vendor has already released a fixed build, this is a broad but readily closable exposure that is best handled through disciplined, fast patch enforcement rather than incident response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB