EUVD-2026-93840
GHSA-mx9j-7v86-jw27
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious media content
-
ExecutionTrigger use-after-free in Media component
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 155.0.8059.39 and to load attacker-controlled web content that exercises the vulnerable Media code path (UI:R - the user must open or visit a crafted HTML page). No authentication or privileges are needed on the target (PR:N). Key limiting factors: it is not automatable at scale because each victim must be individually lured to the malicious page, and code execution is confined to the renderer sandbox - host compromise would require an additional, separate sandbox-escape vulnerability not covered here. |
| Impact | Multiple signals indicate this is a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page). SSVC tempers this: Exploitation=none (no observed in-the-wild activity), Automatable=no (victim must be lured to a page, so it cannot be mass-sprayed), and Technical Impact=total. There is NO CISA KEV listing and NO public exploit code referenced in the input, so exploitation status is 'no public exploit identified at time of analysis'; EPSS is not provided. A critical nuance the raw CVSS score hides: the description explicitly says code executes 'inside the sandbox,' meaning this is renderer-level code execution, not a confirmed full sandbox escape - real-world impact to the host requires chaining with a separate sandbox-escape bug. The CVSS C:H/I:H/A:H therefore reflects worst-case renderer compromise rather than guaranteed host takeover. Net: a high-severity, patch-promptly browser bug given Chrome's reach, but currently neither actively exploited nor automatable, so it ranks below any KEV-listed issue. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious media content that triggers the use-after-free in Chrome's Media component when rendered. A victim running a Chrome version prior to 155.0.8059.39 visits the page (e.g., via phishing or a malvertising redirect), and the attacker gains arbitrary code execution within the renderer sandbox. No public proof-of-concept or active exploitation is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Use-after-free in Google Chrome's Media component allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim into loading a crafted HTML page in any Chrome build prior to 155.0.8059.39. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with Google's own 'High' Chromium security severity, and requires no authentication or privileges on the victim host beyond the user visiting the malicious content (UI:R). Exploitation is confirmed to be constrained by user interaction and by the renderer sandbox - CISA SSVC scores it Exploitation: none, Automatable: no, Technical Impact: total - and there is no public exploit identified at time of analysis, though a vendor-released patch is available.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later, as documented in the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; enabling Chrome's default automatic updates and then verifying the version via chrome://version and restarting the browser is sufficient for most managed and unmanaged endpoints. For organizations that cannot patch immediately, compensating controls should be weighed against their trade-offs: enforce Chrome auto-update via enterprise policy (ChromeBrowserCloudManagement / UpdateDefault=1) so endpoints self-remediate, restrict or block browsing to untrusted sites through a web proxy or URL filtering category list (reduces exposure but is imperfect against compromised or newly registered domains), and keep the renderer sandbox plus Site Isolation enabled (mitigates post-exploitation reach but does not prevent the memory corruption itself). Because exploitation requires the victim to load attacker-controlled HTML, user awareness controls and disabling untrusted plug-in or embedded-media content via policy (for example DefaultPluginsSetting and site-level media restrictions) provide only marginal additional protection and do not substitute for patching. Operators should also monitor for other Chromium-based browsers and embedded Chromium runtimes in their estate, applying equivalent upstream fixes when their vendors publish them, and treat any suspicious renderer crashes in the Media code path as a possible exploitation signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in Chrome's Media subsystem, meaning a heap object tied to media processing (parsing, decoding, or pipeline management of attacker-supplied media content) is freed while a reference to it is still reachable. When the freed memory is subsequently dereferenced, the attacker can influence the contents of that memory region and redirect execution flow, achieving memory corruption and arbitrary code execution within the renderer. Chrome's architecture limits the immediate blast radius: the compromised code runs inside the renderer sandbox, so full host compromise would require chaining an additional, separate sandbox-escape bug. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product family is Google Chrome across all builds below the fixed version, and ENISA's EUVD entry (EUVD-2026-93840) records the affected range as Chrome versions below 155.0.8059.39. The vector PR:N confirms no authentication is needed, while UI:R confirms the attacker must induce a victim to open or visit a crafted HTML page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted web page is network-delivered (AV:N/AC:L/PR:N) but requires the user to visit it (UI:R); sandbox-confined renderer RCE keeps scope unchanged (S:U) with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 contain a high-severity use-after-free vulnerability in the Media component that could allow remote code execution within the browser's renderer sandbox. Employees and other users who browse the web are at risk if they visit a malicious or compromised website, potentially leading to data compromise or unauthorized access. Leadership should prioritize patching to protect organizational assets and user data, as the vulnerability requires only user interaction and no authentication.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB