EUVD-2026-93698
GHSA-xhrm-h5x3-9vfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious video content
-
ExploitTrigger uninitialized resource in Video component
-
ExecutionRead uninitialized sandbox memory
-
ImpactExfiltrate leaked data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled HTML in Chrome (UI:R) that exercises the Video component, triggering the uninitialized resource (CWE-908). No authentication is required (PR:N), but the mandatory user interaction and the fact that the memory read is confined to the renderer sandbox are the key limiting factors - the leak does not by itself breach the sandbox boundary and realistically needs to be chained with a separate sandbox-escape to reach host data. Affects Chrome versions prior to 155.0.8059.39; patched builds are not exploitable. |
| Impact | This is a moderate-severity, low-priority issue despite affecting a ubiquitous product. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated flaw, but it requires user interaction (UI:R - the victim must visit a crafted HTML page) and impacts confidentiality only (C:H, I:N, A:N). All exploitation signals point low: EPSS is 0.24% (13th percentile), there is no CISA KEV listing, and no public POC is identified. The CISA SSVC framework corroborates this with Exploitation: none, Automatable: no, and Technical Impact: partial. Critically, the disclosed memory read occurs INSIDE the renderer sandbox per the description, so an attacker gains information leakage bounded by the sandbox rather than host-level secrets - this materially limits real-world impact and typically requires chaining with a sandbox-escape bug for serious consequences. Signals are consistent (no conflicts): a genuine but non-urgent patch-in-normal-cycle vulnerability, not an emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that triggers the uninitialized-memory condition in Chrome's Video component. When a victim navigates to the page, the attacker reads leftover uninitialized memory within the renderer sandbox, potentially harvesting data useful for further exploitation. No public exploit code is identified at time of analysis, and the read is confined to the sandbox. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Uninitialized memory disclosure in Google Chrome's Video component (all versions prior to 155.0.8059.39) lets a remote attacker read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) with no authentication (PR:N), and the resulting leak is confined to the sandboxed renderer, so it would realistically need to be chained with a separate sandbox-escape to reach host data. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.24% (13th percentile); vendor-released patch 155.0.8059.39 resolves the issue, and CISA SSVC rates exploitation as 'none' with partial technical impact.
RemediationAI
Vendor-released patch: upgrade Google Chrome to version 155.0.8059.39 or later; the fix ships in the Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, and organizations should confirm the deployed version via chrome://version or their endpoint management tooling, restarting the browser so the new build is actually loaded. Patched builds are not exploitable, so no additional mitigation is required once 155.0.8059.39 is in place. If immediate fleet-wide upgrade is not feasible, the practical compensating controls are to enforce Chrome's site isolation and renderer sandbox settings (already default) so the leak remains confined to a single renderer process, and, in higher-assurance environments, to restrict browsing to trusted sites and disable or block untrusted embedded video content via enterprise policy until the update lands - noting that these reduce exposure to crafted HTML but do not eliminate the underlying uninitialized-read defect. Blocking the specific attack vector is not feasible since the trigger is ordinary web content, so patching remains the only complete fix; monitor the Chromium issue tracker at https://issues.chromium.org/issues/504638005 for any follow-up detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-908, Use of Uninitialized Resource, occurring in the Video subsystem of the Chromium rendering engine used by Google Chrome. Under certain crafted-media/HTML conditions the Video component consumes a memory buffer or resource that was never initialized, and the stale contents of that memory are exposed back to the requesting context instead of being zeroed or validated. Because the affected code executes inside Chrome's renderer sandbox, the disclosed bytes are limited to memory the renderer can already address; the flaw does not by itself cross the process/OS trust boundary, which is why the CVSS score is capped at 6.5 (C:H/I:N/A:N) rather than a full compromise. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome browser across all builds earlier than the fixed release, and the Chromium severity rating is Medium. The attack surface is a web page (AV:N/AC:L) that the victim must actively open, making user interaction the primary gating condition.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page with no auth (AV:N/PR:N) but victim must visit it (UI:R); only an in-sandbox memory read, so C:H with I:N/A:N and no scope change.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB