EUVD-2026-93832
GHSA-88cw-8954-q82w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious script drives WebAudio API
-
ExploitTrigger use-after-free in renderer
-
ExecutionCorrupt memory and hijack control flow
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML/JavaScript in Chrome prior to 155.0.8059.39 that exercises the Web Audio API to trigger the use-after-free; this is the UI:R user-interaction requirement (visiting a page) and the only meaningful precondition - no authentication (PR:N) and no non-default configuration are needed, since WebAudio is a standard enabled browser feature. The primary limiting factor is that resulting code execution is confined to the renderer sandbox (S:U), so achieving full host compromise additionally requires a separate sandbox-escape vulnerability; the user-interaction requirement also rules out zero-click exploitation. |
| Impact | Multiple signals align on genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a trivial bar for a browser. CWE-416 use-after-free in WebAudio is a memory-corruption class historically favored for reliable exploitation. However, two containment facts temper raw severity: the description explicitly states code executes 'inside the sandbox,' and the CVSS scope is Unchanged (S:U), meaning a separate renderer-sandbox escape would be needed for full host compromise - so this is high-impact-within-renderer rather than immediate system takeover. On exploitation signals, no EPSS score, no CISA KEV entry, and no public POC were provided in the input, so exploitation status is: no public exploit identified at time of analysis. The Chromium 'High' (not 'Critical') internal rating is consistent with sandboxed RCE. Net: a real, patch-now priority given Chrome's footprint and the low attacker effort, but not evidence of active mass exploitation - treat as urgent patching rather than incident response unless KEV/EPSS data later indicates otherwise. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that abuses the Web Audio API to trigger the use-after-free, then lures a victim to visit it (link, ad, or watering-hole). Successful exploitation corrupts renderer memory to run attacker-controlled code within the Chrome sandbox; full host compromise would require chaining a separate sandbox-escape bug. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Use-after-free in Google Chrome's Web Audio implementation affects versions prior to 155.0.8059.39, where a remote attacker can achieve arbitrary code execution inside the browser's renderer sandbox by getting a victim to open a crafted HTML page that exercises the Web Audio API. The flaw carries an assessed CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or non-default configuration is required, but the attack does depend on user interaction (loading the page) and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. Chromium rates the issue High severity, the vendor has published a fix in 155.0.8059.39, and no public exploit code has been identified at time of analysis; there is no CISA KEV confirmation of active exploitation.
RemediationAI
Upgrade Google Chrome to 155.0.8059.39 or later - the vendor-released patch - using the built-in updater (Settings > About Chrome), then fully relaunch the browser, since Chromium applies updates on restart and un-restarted sessions remain vulnerable. Enterprise administrators should push the fixed build through their software distribution or Chrome Browser Cloud Management and verify the reported version across the fleet via the Chrome version report, and the advisory details are at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html with the engineering record at https://issues.chromium.org/issues/565612897. Until every endpoint is on the fixed build, compensating controls can reduce exposure but each has trade-offs: restricting risky browsing with URLBlocklist/URLAllowlist or blocking JavaScript on untrusted origins via JavaScriptBlockedForUrls policies stops the crafted page from reaching the WebAudio code path but degrades or breaks legitimate web applications on those sites; keeping the renderer sandbox and Site Isolation enforced limits the blast radius to the renderer process, though it does not prevent the initial in-sandbox code execution and can be negated by a chained sandbox-escape flaw. There is no policy that cleanly disables WebAudio without breaking audio-dependent sites, so patching remains the only complete fix, and defenses should assume that renderer-only compromise could be paired with a future sandbox escape. No public exploit code and no confirmed active exploitation were identified at time of analysis, so prioritization should be driven by the high CVSS (8.8) and broad desktop footprint rather than by evidence of in-the-wild use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-416 use-after-free in WebAudio, the Chromium/Blink component that implements the Web Audio API - the browser's audio graph engine built from AudioContext, AudioNode and related objects that JavaScript pages use to synthesize, route and process sound. In a use-after-free of this class, an audio node or its backing buffer is released while a JavaScript-reachable reference still points to it; a subsequent crafted sequence of API calls (node disconnection, context teardown, buffer source reuse or similar) dereferences the dangling pointer, letting an attacker corrupt memory and redirect execution within the renderer process. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is a product-level wildcard rather than a version-bounded entry, so the effective boundary comes from the vendor advisory and the fixed build 155.0.8059.39; the linked Chromium issue tracker entry (issues.chromium.org/issues/565612897) is the authoritative technical record. Because WebAudio is a standard, enabled-by-default browser feature, the attack surface is reachable from any page a user visits, and because the compromise is a memory-safety defect in a JIT-adjacent rendering engine, it is a plausible building block for a browser exploit chain that pairs renderer RCE with a separate sandbox escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N), no privileges but requires visiting the page (PR:N/UI:R); sandboxed code execution keeps scope unchanged (S:U) while giving full renderer C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 155.0.8059.39 carry a use-after-free flaw in the Web Audio component that lets a remote attacker run arbitrary code inside the browser's renderer sandbox simply by persuading a user to open a crafted web page. Because no credentials or special configuration are needed and only a single browsing action triggers it, every employee running an unpatched Chrome build is a potential entry point, making the browser fleet a wide and easily activated attack surface. Although the code execution is confined to the renderer sandbox and full workstation compromise would require an additional sandbox escape, successful exploitation could still expose sensitive data handled in the browser, so leadership should treat fleet-wide browser remediation as a near-term priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB