EUVD-2026-93819
GHSA-r6r2-qr78-r22f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryCompromise renderer via separate bug
-
ExploitServe crafted HTML triggering Video flaw
-
ExecutionRead uninitialized memory across sandbox
-
ImpactExfiltrate leaked data to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (a prior-stage requirement explicitly stated in the description); only then can crafted HTML trigger the uninitialized resource in the Video component to read memory outside the sandbox. It further requires user interaction (UI:R) - the victim must load attacker-controlled content - and an unpatched Chrome build prior to 155.0.8059.39. These factors (dependency on a separate renderer exploit, limited confidentiality-only impact, and the availability of a vendor patch) substantially limit realistic standalone risk; the flaw's practical value is as a sandbox-escape/info-leak primitive within a larger exploit chain. |
| Impact | This is a moderate-but-not-urgent issue. The official CVSS is 4.7 (Medium), and the signals are internally consistent with a low real-world priority: EPSS is 0.19% (8th percentile), it is NOT on CISA KEV, and no public exploit was identified in the provided data. Critically, the CVSS vector lists PR:N (unauthenticated) and AV:N, yet the description explicitly states the attacker must have ALREADY compromised the renderer process - this is a second-stage, chainable info-leak used to read memory across the sandbox boundary (reflected by S:C, C:L), NOT a standalone remotely-exploitable flaw. This conflict should be read as: PR:N reflects that the triggering content is attacker-supplied web content, but the real prerequisite is a prior renderer-level RCE/compromise, so in isolation this bug is not weaponizable. Chromium's own rating of 'High' reflects its value as a sandbox-escape primitive when chained, which is why it is worth patching promptly despite the low CVSS and low EPSS. Impact is limited to confidentiality (C:L, I:N, A:N) - an information disclosure, not code execution on its own. |
| Exploit ScenarioDerived | An attacker first compromises the Chrome renderer process (e.g., via a separate V8/renderer RCE bug) when a victim visits a malicious page, then serves crafted HTML that triggers the uninitialized resource in the Video component to read memory that lives outside the renderer sandbox. No public exploit was identified at time of analysis; realistically this would be one link in a multi-bug exploit chain rather than used alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
An uninitialized resource flaw in the Video component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has already compromised the renderer process to craft an HTML page that reads memory outside the sandbox, leaking limited information. The vulnerability requires both a pre-existing renderer compromise and user interaction (victim must load attacker-controlled content), and no public exploit has been identified at time of analysis; EPSS is low at 0.19% (8th percentile). Our independent assessment rates this as a moderate-but-not-urgent issue - its practical value is primarily as a sandbox-escape/info-leak primitive within a larger exploit chain rather than a standalone attack, and a vendor patch is available.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.39. Upgrade to Chrome 155.0.8059.39 or later via the Chrome stable-channel update described in the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; enterprise administrators should push the update through their normal Chrome management pipeline and verify build version 155.0.8059.39 on all endpoints. Because exploitation requires the attacker to have already compromised the renderer process, the most effective compensating controls are those that reduce renderer-compromise risk and limit post-compromise impact: enable Chrome's Site Isolation (on by default in modern builds, but verify it is not disabled by policy), keep the renderer sandbox enabled (do not run with --no-sandbox), restrict untrusted web content via URL allow/block lists, and enforce strict site isolation for high-value internal applications - all of which trade off some performance and cross-site functionality for reduced exposure. Users should avoid loading untrusted HTML content until patched. Note that because this bug is confidentiality-only and requires a separate renderer exploit as a prerequisite, there is no single configuration toggle that fully mitigates it other than updating; the patch is the only complete fix. References: https://issues.chromium.org/issues/553118338 and https://nvd.nist.gov/vuln/detail/CVE-2026-106273.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-908 (Use of Uninitialized Resource) is the root cause class here: the Video component fails to properly initialize a resource before use, allowing a renderer that has already been compromised to read memory outside the Chrome sandbox. The affected component is the Video subsystem within Chromium, and the exposed CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms Google Chrome as the affected product, with EUVD listing affected versions as Chrome prior to 155.0.8059.39. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N per NVD, adjusted to AC:H in our independent assessment) indicates network attack vector, no privileges required, user interaction required, scope change, and confidentiality-only impact of Low - consistent with a memory disclosure limited to information leakage rather than code execution or data modification. The uninitialized-memory primitive is one of the classic sandbox-escape building blocks: it does not itself break out of the renderer sandbox, but rather lets an already-compromised renderer leak host/out-of-sandbox memory, which an attacker can then use to defeat ASLR or locate further exploitation targets. Chromium's renderer sandbox is designed specifically to contain such renderer-compromise scenarios, which is why the flaw's severity is bounded by the dependency on a prior renderer exploit stated in the description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
AC:H because exploitation depends on a pre-compromised renderer (a non-trivial precondition); S:C and C:L for a confidentiality-only read across the sandbox boundary; PR:N as the trigger content is attacker-supplied.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB