EUVD-2026-93829
GHSA-prv7-w76c-77w5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger use-after-free in TabStrip
-
ExploitGroom freed memory and corrupt objects
-
ExecutionExecute code and escape sandbox
-
ImpactRun arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or interact with an attacker-controlled crafted HTML page in Chrome (UI:R / social engineering) - it is not a zero-click, drive-by-silent bug against a passive target. No authentication is required (PR:N) and the default browser configuration is sufficient; there is no need for a special feature flag or enterprise setting. The practical limiting factors are: successful social engineering to induce the page visit/interaction, the victim running a vulnerable version prior to 155.0.8059.39, and the attacker reliably winning the use-after-free race and defeating sandbox/ASLR mitigations to achieve the out-of-sandbox code execution. |
| Impact | This is a genuine high priority despite the absence of exploitation signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated bug whose only gating factor is user interaction (UI:R), and the scope change (S:C) plus the description's explicit 'execute arbitrary code outside the sandbox' language indicate a full browser sandbox escape - the most dangerous class of Chrome memory-corruption bug. The signals are internally consistent rather than conflicting: CVSS AV:N aligns with delivery via a 'crafted HTML page,' and UI:R aligns with the description's 'leveraging social engineering.' Counterweighting the high CVSS, the CISA SSVC decision framework reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no indication of public POC code in the supplied data, so current real-world exploitation pressure is low even though Technical Impact is rated total. Net: treat as urgent-patch (RCE + sandbox escape in a ubiquitous browser) but not yet an actively-exploited emergency. Note the Tags include 'Denial Of Service,' which is a plausible secondary outcome of a use-after-free but is secondary to the RCE impact emphasized by the description and CWE-416. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML and uses social engineering (phishing link, malvertising, or a lured click) to get a victim to visit it in a vulnerable Chrome build before 155.0.8059.39. The page triggers a use-after-free in the TabStrip component, which the attacker grooms to achieve arbitrary code execution that escapes the renderer sandbox and runs on the host. No public exploit code is identified in the available data at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Out-of-sandbox code execution is achievable in Google Chrome desktop builds prior to 155.0.8059.39 by exploiting a use-after-free in the browser-process TabStrip component, reached when a victim is socially engineered into opening an attacker-crafted HTML page. The flaw carries a 9.6 CVSS (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the corrupted component sits outside the renderer sandbox, so a successful exploit escapes Chrome's primary containment boundary; however, it is not a zero-click bug and no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with Automatable 'no'. A vendor-released patch (155.0.8059.39) is available, making this a high-priority but currently non-weaponized patch-now item rather than an active incident.
RemediationAI
Upgrade Google Chrome to 155.0.8059.39 or later; this is the exact fix version referenced by the vendor advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, mirrored at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html), and patch availability is confirmed from the vendor. On managed endpoints, push the update through Google Update / enterprise policy and force a browser restart, since Chrome only activates the new binary after all instances are closed; verify with chrome://version. There is no feature-toggle workaround for this bug: the TabStrip component cannot be disabled, and renderer-level controls such as site isolation or disabling JavaScript do not mitigate a browser-process use-after-free, so any interim control is partial at best. Where immediate patching is impossible, the realistic compensating measures are to constrain browsing to an allowlisted set of trusted sites (accepting the loss of general web access), run untrusted browsing inside a disposable VM or remote browsing isolation service so a compromise does not touch the production host, and ensure OS exploit mitigations (ASLR, hardware-enforced stack protection) and EDR are active to raise the cost of the post-UAF exploitation step - trade-offs being reduced usability and a residual risk window that only the patch actually closes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in TabStrip, the Chromium UI component that renders and manages the browser's tab bar. Unlike renderer-side bugs in Blink or V8, TabStrip code executes in the privileged browser process, which is why the CVSS vector includes S:C (scope change) and why successful corruption yields arbitrary code execution outside the renderer sandbox. The technical primitive is a dangling pointer: an object associated with tab-strip state is freed while a reference to it survives, and the stale reference is later dereferenced (or a controlled reallocation of the freed chunk occurs) to hijack execution. The vector requires UI:R, meaning the attacker must induce the victim to load the malicious HTML - consistent with the Chromium severity rating of High and the reference to a Chromium issue tracker entry (issues.chromium.org/issues/562002095). Because the flaw lives in browser-process UI code rather than sandboxed web content, standard renderer hardening (site isolation, out-of-process iframes) does not contain it, and the attacker must additionally win the heap-reuse race and defeat platform mitigations such as ASLR to convert the UAF into reliable code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Delivered remotely via crafted HTML (AV:N) with only a required user click (UI:R, PR:N); the explicit out-of-sandbox code execution justifies S:C with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop versions prior to 155.0.8059.39 contain a critical memory-corruption flaw in the browser-process TabStrip component that allows an attacker to execute code outside Chrome's sandbox. Any employee who browses to a crafted web page while using an unpatched browser could be exposed to full endpoint compromise, meaning the risk extends beyond the browser to any data or credentials accessible from that workstation. A vendor fix already exists and there is no evidence of active exploitation, so this is a manageable, time-bound patching obligation rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB