EUVD-2026-93687
GHSA-hm7m-pmxr-86jq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted web page
-
ExploitChrome Media component parses malicious content
-
ExecutionTrigger use-after-free (CWE-416)
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user running an affected Chrome build (prior to 155.0.8059.39) to actively visit or load an attacker-controlled web page containing crafted HTML/media that is processed by Chrome's Media component - this user interaction (UI:R) is the primary limiting factor. No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected. The key constraint on real-world impact is that code execution is confined to the renderer sandbox ('inside the sandbox' per the description); full host compromise would require chaining an additional sandbox-escape vulnerability. Users on the patched version or with auto-update enabled are not exposed. |
| Impact | This is a genuine high-severity memory-safety flaw in a ubiquitous product, but the exploitation signals are notably mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 because a remote, unauthenticated attacker can achieve code execution with only a single user action (visiting a page), and the SSVC Technical Impact is rated 'total,' consistent with a use-after-free (CWE-416) yielding arbitrary code execution. Counterbalancing this, SSVC Exploitation is 'none' and Automatable is 'no,' there is no CISA KEV listing and no public exploit identified, and Google classified the Chromium security severity as only 'Medium' - meaning the impact is constrained because execution occurs inside the renderer sandbox rather than at full OS privilege, so a sandbox escape would be required for a complete compromise. No EPSS score was provided in the input, so the market-derived exploitation probability cannot be weighed here. Net: a real patch-now priority given Chrome's footprint and the 'total' technical impact, but not an emergency - there is no evidence of active exploitation, UAF-in-renderer bugs are non-trivial to weaponize reliably, and the sandbox boundary limits real-world blast radius absent a chained escape. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML/media content and lures a Chrome user (via link, ad, or watering-hole) into visiting it. When Chrome's Media component processes the content, the use-after-free is triggered and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified at time of analysis, and the CVSS vector requires user interaction (UI:R) with low attack complexity (AC:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
A use-after-free memory-safety flaw in Google Chrome's Media component lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a user loads a crafted HTML page containing malicious media content. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires the victim to visit or load the attacker-controlled page (UI:R), which is the main practical barrier; no credentials or special privileges are needed. There is no public exploit identified at time of analysis and the CISA SSVC assessment records no exploitation, but the vendor has shipped a fix in 155.0.8059.39, and the EPSS-style risk picture is dominated by Chrome's ubiquity and the high CVSS base score (8.8) rather than by observed attacks.
RemediationAI
Upgrade to Google Chrome 155.0.8059.39 or later - the vendor-released patch - via the built-in updater or a fresh install from the official channel, then verify the version in chrome://version; the release notes are at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the bug record at https://issues.chromium.org/issues/502105238. Enabling/keeping automatic updates and relaunching the browser to apply the pending version is the highest-value action, since this is a default-configuration flaw requiring no authentication and no non-default settings. If immediate upgrade is impossible, compensating controls are limited and each carries trade-offs: force media playback behind click-to-play (chrome://settings/content/sound and site-level autoplay restrictions) and use enterprise policy to block media autoplay and restrict access to untrusted sites (DefaultPluginsSetting/autoplay allowlists), which reduces the chance of silent trigger pages but does not stop a user who deliberately clicks play and may break legitimate streaming/internal media apps; run untrusted browsing in a separate, low-privilege profile or VM, which adds isolation but costs usability and management overhead; and keep the renderer sandbox enabled and unfetched - since the described code execution is contained 'inside the sandbox', maintaining strict sandbox and site-isolation settings limits the blast radius, though it does not eliminate the memory-corruption bug itself. Note that no fully effective workaround substitutes for the 155.0.8059.39 update, and blocking media content wholesale is generally impractical.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, use-after-free, occurring in Chrome's Media component - the Chromium media stack that parses, decodes and renders media data (media element playback, codec/demuxer handling, WebCodecs-style worker paths). A use-after-free means a heap object is released while a stale pointer to it is still reachable; if the attacker can control the freed memory's contents, that dangling reference can be turned into controlled writes or an indirect-call hijack. Because the corruption occurs while processing attacker-supplied media data, the vulnerable path is reachable from ordinary web content, which is why the vector is AV:N/PR:N with only UI:R (the victim must load the page). Per the vendor description the resulting code execution is confined to the renderer's sandbox, so on its own the flaw yields attacker-controlled execution in a compromised renderer process - not a host-level takeover - and a full compromise would require chaining an additional sandbox-escape bug. CPE coverage is the generic Chrome entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD lists the affected range as Chrome builds below 155.0.8059.39; the bug is tracked upstream as Chromium issue 502105238 and was rated Medium under Google's own Chromium severity scale even though the CVSS 3.1 base score computes to 8.8 (C:H/I:H/A:H) because of the sandbox and user-interaction constraints.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/PR:N but needs a visit (UI:R); execution stays in the sandbox so S:U, with high C/I/A from arbitrary code execution.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome, the most widely deployed browser in the enterprise, is affected by a high-severity remote code execution vulnerability that requires user interaction but poses a significant risk due to its broad install base. All versions prior to 155.0.8059.39 are impacted, and there is no public exploit identified at time of analysis. Leadership should ensure rapid patching to protect organizational data and maintain user productivity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB