EUVD-2026-93751
GHSA-rjj9-c949-5476
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via prior bug
-
DeliveryServe crafted HTML font payload
-
ExploitTrigger heap overflow in Fonts (CWE-122)
-
ExecutionCorrupt memory to escape sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (per the description) and that the victim loads a crafted HTML page containing malicious font data that reaches Chrome's font-handling code - this is explicitly a sandbox escape, not a standalone remote RCE. Limiting factors: user interaction is required (UI:R - victim must open/render the page), attack complexity is high (AC:H), and a working renderer-compromise exploit must already be in hand, so it functions as a chain component rather than a one-shot drive-by. Affects Chrome versions prior to 155.0.8059.39 on default configurations; updating to 155.0.8059.39 or later removes the condition. |
| Impact | This is a genuine but conditional risk rather than an immediately actionable emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) reflects a sandbox-escape primitive: network-reachable via a crafted HTML page, no authentication (PR:N), but requiring user interaction (UI:R), high attack complexity (AC:H), and producing a scope change (S:C) with total CIA impact - consistent with escaping the Chrome renderer sandbox to the host. Critically, the description states the attacker must ALREADY have compromised the renderer process, so this is a second-stage bug typically chained with a separate renderer RCE rather than a standalone drive-by. The signals are mostly aligned toward LOWER urgency: SSVC reports Exploitation:none and Automatable:no (the renderer-compromise prerequisite and UI requirement defeat mass automation), while Technical Impact:total matches the S:C/C:H/I:H/A:H scoring. There is no CISA KEV listing and no public POC in the provided data, and EPSS was not supplied. The apparent tension between the Chromium-assigned 'Medium' severity and the NVD-style 8.3 'High' score is normal for Chrome sandbox escapes - Chromium rates by exploitability-as-shipped (needs a prior renderer compromise), while the base CVSS assumes that precondition is met. Net: a real patch-this-promptly browser bug, but not a widespread opportunistic-exploitation priority absent a working exploit chain. |
| Exploit ScenarioDerived | An attacker who has already achieved code execution inside the Chrome renderer (via a separate vulnerability) lures or directs the victim to a crafted HTML page that triggers a heap buffer overflow in Chrome's font handling, corrupting memory to execute arbitrary code outside the renderer sandbox on the host. No public exploit code is identified at time of analysis, and the high complexity (AC:H) plus the renderer-compromise prerequisite make this realistic only as the second link in a multi-bug exploit chain. Successful exploitation yields full code execution with the browser process's privileges on the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Heap-based buffer overflow in Google Chrome's font-handling code (CWE-122) lets an attacker who has already compromised the renderer process execute arbitrary code outside the sandbox when a victim renders a crafted HTML page containing malicious font data. All Chrome builds prior to 155.0.8059.39 on default configurations are affected; exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and a pre-existing renderer compromise, so it functions as a sandbox-escape chain component rather than a standalone drive-by, and is rated high complexity (AC:H) despite a CVSS base of 8.3 (S:C). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, but the vendor has shipped a fix in 155.0.8059.39.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later, which is the fix version shipped in the stable channel update documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, with details in the Chromium issue at https://issues.chromium.org/issues/524587778. Because Chrome's updater stages code in the background, confirm the running version after a full browser restart and force the check via chrome://settings/help; managed fleets should push the version through the Google Update/Chrome Browser Cloud Management policies (for example, the relaunch-notification and update-enforcement policies) so the patched build is actually in use rather than merely downloaded. Until endpoints reach 155.0.8059.39, treat this as a chain component and prioritize blocking the earlier renderer-compromise step: keep Site Isolation enabled (it is on by default, and disabling it would materially increase escape impact), avoid untrusted browsing on unpatched hosts, and, where acceptable, use enterprise URL allowlisting policies to restrict unpatched browsers to trusted sites - the trade-off being reduced user flexibility. There is no practical way to disable Chrome font rendering for selective content, so font-level workarounds are not recommended; since the bug requires a pre-existing renderer compromise plus user interaction, tightening renderer-side defenses and phishing/user-interaction controls is a reasonable interim compensating measure, but applying the 155.0.8059.39 update is the only complete fix. No public exploit code has been identified at time of analysis, so emergency out-of-band rollouts are not mandated by active exploitation, though the update should still be scheduled promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) in the font parsing/rendering path of Chromium, the open-source engine underlying Google Chrome and tracked generically as cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. Font handling involves parsing attacker-influenceable binary font tables, and a length or bounds miscalculation during that parsing lets malformed data overwrite adjacent heap memory. Notably, the vulnerable code path relevant to this issue executes with privileges beyond the renderer sandbox boundary, which is why corrupting it yields code execution outside the sandbox rather than merely a renderer crash; the renderer must therefore already be compromised for the overflow to be reached in that higher-privilege context. Per the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, the scope change reflects the sandbox escape, while AC:H and UI:R reflect the prerequisite renderer compromise and the need for the victim to load the crafted page. The Chromium security severity is rated Medium by the vendor, consistent with a conditional chain primitive rather than a one-shot remote exploit.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Crafted page is network-delivered (AV:N) needing a victim to load it (UI:R) and a chained renderer compromise (AC:H); PR:N as no account is needed, and sandbox escape gives S:C with full host CIA impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A high-severity memory-safety flaw in Google Chrome's font-rendering code allows code execution to break out of the browser sandbox, meaning an attacker who has already breached a web page's renderer process could escalate to the underlying workstation or server. Because Chrome is widely deployed across the workforce, unpatched endpoints represent a meaningful escalation path for attackers who chain this with a separate entry point, though no exploitation has been observed to date and the attack requires both a prior compromise and user interaction. Leadership should treat this as a fleet-wide hygiene issue for the browser rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB