EUVD-2026-93673
GHSA-25qq-fq2w-59j4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page (UI:R)
-
DeliveryServe crafted HTML content
-
ExploitTrigger use-after-free in Streaming
-
ExecutionReuse freed object for memory corruption
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit or load attacker-controlled web content in Chrome - the CVSS UI:R and the description's 'leveraging social engineering ... via a crafted HTML page' confirm user interaction is mandatory, so this cannot be triggered silently against a browser at rest. The specific trigger is the Streaming component processing malicious page content on Chrome versions prior to 155.0.8059.39. The principal limiting factor is that successful code execution is confined to the renderer sandbox: converting this into full host compromise requires chaining a separate sandbox-escape vulnerability. No authentication or special non-default configuration is needed (PR:N), but up-to-date browsers (155.0.8059.39 or later) are not affected. |
| Impact | Signals are largely concordant toward a serious but not emergency-grade issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only user interaction, which is why it scores High. However, this is tempered by several factors: Google rated the Chromium security severity as Medium (not Critical), the description explicitly states code execution occurs 'inside the sandbox' - meaning a separate sandbox-escape would be needed for full host compromise - and CISA's SSVC framework records Exploitation: none and Automatable: no (consistent with a social-engineering-dependent, per-victim attack rather than mass exploitation). This CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided, so exploitation probability cannot be quantified from the input. Net: this is a legitimate patch-now item for Chrome's enormous install base, but the SSVC 'none/no' values, Medium vendor rating, and in-sandbox limitation argue this is important routine browser patching rather than an actively-exploited priority. The CVSS C:H/I:H/A:H impact is slightly optimistic given the sandbox constraint - treat full RCE as contingent on chaining a sandbox escape. |
| Exploit ScenarioDerived | An attacker lures a Chrome user (via phishing link, malicious ad, or compromised site) to a crafted HTML page that triggers a use-after-free in the Streaming component. When the freed object is reused, the attacker gains memory corruption and can potentially execute arbitrary code within the renderer sandbox; achieving full host compromise would require an additional sandbox-escape bug. No public exploit code was referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Use-after-free in the Streaming component of Google Chrome prior to 155.0.8059.39 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim is socially engineered into loading a crafted HTML page, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:R. Google rates the issue Medium severity (Chromium) while the CVSS base score is 8.8, reflecting high confidentiality, integrity, and availability impact on the renderer process rather than the host. There is no CISA KEV listing and no public exploit identified at time of analysis, and the SSVC assessment records exploitation as none; the primary containment is Chrome's process sandbox, so full host compromise would require chaining a separate sandbox-escape flaw.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later, distributed through the Chrome Stable Channel Update for Desktop (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html); end users can force the update via chrome://settings/help followed by a full browser restart, and enterprises should verify fleet compliance through Google Update or Chrome Browser Cloud Management policies, since Chrome only becomes protected after the update is applied and the process restarted. No patch was identified as unavailable - the fix is included in the referenced stable channel build. Because successful exploitation is contained by the renderer sandbox, the most valuable compensating controls are ones that preserve that boundary: never launch Chrome with --no-sandbox or disable Site Isolation (disabling Site Isolation would remove the process-level containment that limits this bug and its class, at the cost of higher memory use when left enabled), and keep extensions and privileged browser flags restricted to reduce the chance a sandbox-escape primitive is already present on the endpoint. Additional risk reduction can come from blocking or filtering untrusted web content at the network/proxy layer, restricting user browsing through enterprise URL policies, and prioritizing rapid patching for users who routinely browse untrusted sites; each of these reduces the probability that a victim is socially engineered into the crafted page but none is a substitute for the update, which remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Chrome's Streaming component, the part of the media/streaming pipeline that parses and services stream-related content delivered by web pages. In a use-after-free, an object is freed while a dangling reference remains; subsequent attacker-influenced operations on that stale pointer corrupt heap memory, which can be groomed into controlled writes and ultimately arbitrary code execution within the renderer process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity attack requiring no privileges but mandatory user interaction, with scope unchanged - meaning the demonstrated impact stays inside the compromised renderer, not the host. Chrome's multi-process architecture and sandbox are the key mitigating technology here: the renderer is treated as untrusted, and escaping it into the browser or OS requires an additional vulnerability. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and the vendor advisory identify affected builds as any Google Chrome release earlier than 155.0.8059.39 across supported desktop platforms; the issue is tracked upstream as Chromium issue 499468981.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted HTML with no privileges but mandatory user interaction (UI:R); use-after-free yields high C/I/A, though impact is realistically capped by the renderer sandbox (scope unchanged).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 are affected by a high-severity use-after-free vulnerability in the Streaming component, which could allow an unauthenticated remote attacker to execute code within the browser's renderer sandbox if a user is socially engineered into visiting a malicious page. Although the sandbox limits the impact to the renderer process and no public exploit identified at time of analysis, successful exploitation could lead to unauthorized access to sensitive data within the browser session, affecting any employee using an unpatched Chrome instance. Leadership should prioritize patching because a vendor-released patch (155.0.8059.39) is available, and timely remediation will prevent potential data breaches and maintain user trust.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB