Use After Free
Monthly
Stale arm64 TLB entries in Zephyr RTOS 4.3.0 through 4.4.2 let an unprivileged user thread (CVSS PR:L, local access) retain read/write mappings to a physical page frame after the demand paging eviction algorithm has reclaimed and reissued that frame to the kernel or to another memory domain. Because the single-VA invalidation only ever matched ASID 0 and global entries, a domain-private non-global leaf created for a k_mem_partition or a user thread stack survives page-out, enabling information disclosure and memory corruption that breaks CONFIG_USERSPACE isolation with scope-changing impact beyond the vulnerable component. Exploitation requires an arm64 build with both CONFIG_USERSPACE and the experimental CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain; the attacker must already be running user-mode code and must drive memory pressure to force eviction and immediate frame reuse (AC:H). No public exploit code or PoC reference was identified in the available sources and the issue is not listed in CISA KEV; vendor fix commits are merged upstream on main with a projected fixed version of 4.5.0, while branch backports remain open.
A heap use-after-free in OpenWrt's odhcpd DHCPv6 IA handler allows an unauthenticated client on the same local link or an adjacent IPv6 network to crash or corrupt the router's DHCPv6/RA daemon. The flaw lives in the per-message `first` lease pointer used to reuse a Reconfigure authentication key across multiple IA options: a REQUEST that binds one IA, then fails the on-link check on a later IA with the same IAID, frees the lease that `first` still references, and a subsequent IA copies 16 bytes from that freed chunk into a new lease's key. The validated impact is adjacent-network denial of service plus Reconfigure/ForceRenew key confusion (deterministically an all-zero key under the traced reclaim pattern); arbitrary code execution is not proven for this UAF alone, and a public maintainer reproduction bundle demonstrates the crash under ASan. It is not confirmed actively exploited (no CISA KEV listing), but it carries a 'this_week' priority and affects essentially every OpenWrt release from 18.06 through the 25.12 package pin.
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
Denial of service in NLnet Labs Unbound versions 1.22.0 through 1.26.1, where a remote DNS-over-QUIC client can crash the resolver by triggering a QUIC path migration at the moment a mesh reply still holds a pointer to the associated DoQ stream. The resulting use-after-free dereferences the freed stream when the pending reply completes, terminating the process and interrupting DNS resolution for all clients of that instance. Exploitation is race-dependent and only possible when DoQ is enabled and Unbound runs multi-threaded; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but bounded availability risk rather than a wormable or data-exposing flaw.
Code execution can occur in sharp versions before 0.35.5 when an application decodes attacker-supplied SVG images through the bundled librsvg, which contains the use-after-free tracked as CVE-2026-96889. The RCE outcome is constrained to glibc-based Linux and Node.js executables that are not built as PIE, so many distribution-packaged Node.js deployments are protected from code execution even though the underlying memory corruption remains. No public exploit was identified at time of analysis; SVG decoding can be disabled with sharp.block as a workaround.
Denial of service in FreeRDP 3.32.0: a use-after-free in the drdynvc dynamic virtual channel allows a malicious RDP server to crash the client during teardown by sending one crafted Virtual Channel PDU with a totalLength smaller than the chunk size. The victim must initiate an RDP session to the attacker-controlled or compromised server (UI:P), so passive clients are not exposed; the assessed impact is availability-only with no confidentiality or integrity loss. No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV.
Unauthenticated remote code execution in PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12 arises when an attacker drives a worker into an out-of-memory condition while request memory is only partially initialized, leaving freed/reused structures that the request shutdown path then processes. Exploitation is confirmed practical against Apache mod_php with default input and memory limits in normal multi-worker prefork setups, and publicly available exploit code exists; the vendor and distros (Ubuntu USN-8948-1) have released fixed builds. With a 9.2 CVSS score, a public PoC, and an act_now priority decision, this warrants immediate patching, though reliability varies with build, extensions, frontend behavior and allocator layout, and no complete PHP-FPM exploit has been demonstrated.
Use-after-free in PHP's per-request global state handling lets unauthenticated remote attackers achieve arbitrary code execution against persistent workers that reuse memory across requests - PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. Exploitation is high complexity (CVSS:4.0 9.2 with AC:H/AT:P): it needs a 'producer' operation that leaves request-owned state published after an interruption such as a fatal error, uncaught exception, timeout or OOM, followed by a later request to the same worker whose early operation consumes the stale pointer before normal initialization resets it. The vendor documents a confirmed mod_php RCE path (PHP 8.5 with fatal_error_backtraces enabled) and a confirmed session upload progress lifecycle; a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none, and the priority decision is act_now because affected PHP branches are patched and technical impact is total.
Use-after-free in Google Chrome's Performance component (all desktop builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact, but exploitation requires the user to actively visit or render attacker-controlled content and, per Google's advisory, code execution is confined to the Chrome sandbox - host-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in SVG rendering in Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 with UI:R, so exploitation requires user interaction such as visiting attacker-controlled content; no public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Turbolev component affects versions prior to 156.0.8078.47 and lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (the victim must visit or render the malicious page), and successful code execution is confined to the sandbox; host compromise would require chaining a separate sandbox-escape flaw. Google rates this High severity (CVSS 8.8), and no public exploit was identified at time of analysis, though a vendor patch is available.
Use-after-free in Google Chrome's Chromecast component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page on any build prior to 156.0.8078.47. Exploitation is not passive: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms mandatory user interaction, and the impact is bounded by Chrome's renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape flaw. Priority signals conflict - Chromium rates the issue Medium while the derived CVSS is 8.8 - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security contact and restricts technical detail in the tracker.
Use-after-free in Chrome's GPU process lets remote attackers achieve code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires user interaction (UI:R) with no authentication needed (PR:N), though the code execution is confined to the GPU process sandbox (S:U) unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Use-after-free memory corruption in Google Chrome for iOS prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attacker needs no credentials but must convince the target to open a malicious page, and any resulting code execution stays confined to the Chrome sandbox on iOS - escaping to the underlying device would require a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the risk picture is mixed: Google's Chromium team rates the flaw Low severity, while the CVSS 3.1 base score computes to 8.8 because of the high confidentiality, integrity and availability impact assumed for successful code execution; a vendor patch (156.0.8078.47) is available, so prioritization should weigh the Low vendor rating against the 8.8 vector rather than treating either signal as authoritative.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page corrupt memory and execute arbitrary code inside the renderer sandbox, and can additionally crash the browser. Exploitation is not passive: it requires the target to load attacker-controlled web content, and because the CVSS scope is Unchanged, code execution stays confined to the sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though Chrome renderer memory-corruption bugs are historically attractive to exploit developers; the risk picture is mixed, with Chromium's own severity rating of Medium sitting well below the 8.8 CVSS score derived from the high confidentiality and integrity impact.
Code execution inside the renderer sandbox is possible in Google Chrome builds prior to 156.0.8078.47 because of a use-after-free in the Accessibility component. A remote, unauthenticated attacker can trigger the flaw with a crafted HTML page, but exploitation requires the victim to visit attacker-controlled or attacker-injected content (UI:R), and the resulting code execution remains confined to the renderer sandbox unless chained with a separate sandbox escape. The vendor has released Chrome 156.0.8078.47 to fix the issue; no public exploit was identified at time of analysis.
Code execution inside Google Chrome's renderer sandbox is possible before version 156.0.8078.47 because of a use-after-free in the Media component that is triggered when a victim loads a crafted HTML page. The issue is unauthenticated from the attacker's perspective but requires user interaction (the victim must open the page), and the assessed CVSS vector scores it 8.8 with Scope:Unchanged, meaning compromise is confined to the sandbox unless a separate sandbox-escape flaw is chained. No public exploit was identified at time of analysis, and Google has released a fixed build, 156.0.8078.47; note that Chromium rated the bug Low severity while the CVSS score is High, a conflict that should inform risk decisions.
Use-after-free in Chrome's ServiceWorker implementation allows a remote, unauthenticated attacker to run arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page that registers or manipulates a ServiceWorker, affecting Chrome builds prior to 156.0.8078.47. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high confidentiality, integrity, and availability impact, it scores 8.8, yet Google rates the issue only Medium - the description explicitly scopes the code execution to 'inside the sandbox,' so host or OS compromise requires chaining a separate sandbox-escape flaw. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad browser install base make this a genuine patch-priority item; note that exploitation requires user interaction (the victim must navigate to or render attacker-controlled content).
Google Chrome before 156.0.8078.47 contains a use-after-free in the Core component that can lead to arbitrary code execution inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R (score 8.8), so no authentication is required, but user interaction is the gating condition and the code execution is sandbox-confined unless chained with a separate escape. No public exploit code was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Privacy component lets a remote attacker execute arbitrary code inside the renderer sandbox on any build prior to 156.0.8078.47, triggered simply by getting the victim to load a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R, scope unchanged). The flaw is a heap memory-lifetime corruption issue (CWE-416) whose realistic outcomes are renderer-level code execution or a browser crash/denial of service; escaping to the host operating system would require chaining a separate sandbox-escape bug, and Chrome's automatic updater rapidly shrinks the exposed population once the stable fix lands. Google shipped 156.0.8078.47 as the patched stable release, tracked as Chromium issue 558464760 and rated High by the Chromium security team; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Use-after-free memory corruption in Google Chrome's Extensions component (all versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to load a crafted HTML page run arbitrary code inside the browser sandbox; no authentication or prior privileges are required, but the victim must actively render attacker-controlled content (UI:R), and the resulting execution is confined to the sandbox. Rated 8.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H, CWE-416) with Chromium severity Medium - the gap reflects the sandbox boundary, which an attacker would need a separate escape to cross. No public exploit code and no CISA KEV listing were identified at time of analysis; a vendor patch is available.
Sandboxed remote code execution in Google Chrome prior to 156.0.8078.47 is caused by a use-after-free in the Transactions Platform component and is reachable when a victim loads a crafted HTML page. The issue is unauthenticated and low-complexity but requires user interaction, and code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. Multiple signals make this a genuine but not emergency-tier priority: a vendor patch is available, and no public exploit identified at time of analysis.
Use-after-free in ANGLE, the WebGL/GPU translation layer shipped with Google Chrome on Windows, allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. The CVSS 3.1 vector (8.8 High, AV:N/AC:L/PR:N/UI:R) reflects an unauthenticated, low-complexity attack that hinges only on the user visiting attacker-controlled content, a routine browsing action, though the CVSS integrity/availability impact is scored independently of the sandbox boundary that actually contains the payload. Google rates the underlying Chromium issue High severity; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but browser memory-corruption bugs of this class are routinely chained with a separate sandbox escape for full host compromise.
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page (CVSS 8.8, UI:R). The raw score is high, but the independent assessment notes that code execution is confined to the renderer; full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or CISA KEV entry was identified at time of analysis, so risk signals are mixed and should be weighed with the user-interaction and sandbox constraints.
Google Chrome before 156.0.8078.47 contains a use-after-free in its Prompts component that can be triggered when a user opens crafted HTML content, allowing arbitrary code execution within the renderer sandbox. The CVSS vector indicates a remote, unauthenticated attack with required user interaction and high confidentiality, integrity, and availability impact, although Google rates the Chromium severity as Low and host-level compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the flaw.
Arbitrary code execution inside the Chrome renderer sandbox on macOS is possible with Google Chrome versions prior to 156.0.8078.47 when a user opens a crafted HTML page. The flaw is a use-after-free in Views rated CVSS 3.1 8.8 (High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requiring user interaction but no authentication; code execution is confined to the renderer unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
A use-after-free in Google Chrome's Extensions component (CWE-416) affects all builds prior to 156.0.8078.47 and lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting low complexity and no authentication requirement but a mandatory user-interaction step; impact is confined to the sandbox, so host-level compromise would require chaining a separate sandbox escape. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Google rates the Chromium security severity as Medium.
Use-after-free in Google Chrome's API layer prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (8.8) confirms network reachability and no privileges required, but exploitation is not zero-click: it requires user interaction to render the crafted page, and the impact is scope-limited to Chrome's sandbox (S:U). Google has released a fixed build, and no public exploit code was identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the ReadingMode component of Google Chrome builds prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and Google's own Chromium severity rating for this issue is Low - a sharp conflict with the 8.8 base score that materially changes how the risk should be weighed. Because the description confines the code execution to the sandbox, a complete host compromise would require chaining a separate sandbox-escape bug that this CVE does not supply; no public exploit was identified at the time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Accessibility component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit was identified at time of analysis. Google rates the Chromium security severity Critical, and affected users should update to 156.0.8078.47.
Use-after-free in Google Chrome's Internals component before 156.0.8078.47 allows a remote attacker to escape the browser sandbox and execute arbitrary code when a victim loads a crafted HTML page. The flaw is unauthenticated from the attacker's perspective but requires victim interaction (UI:R), and the scope change plus high confidentiality, integrity, and availability impact produce a Critical 9.6 base score. No public exploit code or confirmed active exploitation was identified at time of analysis; Google has released the fixed 156.0.8078.47 build.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 (Critical), driven by the scope change reflecting a sandbox escape, although Chromium rates the flaw Medium and the vendor describes code execution outside the sandbox as potential. Exploitation requires user interaction to load the crafted page; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 lets unauthenticated remote attackers potentially execute arbitrary code inside the Chrome sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R), and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining with a separate sandbox escape. No public exploit was identified at time of analysis, but the vendor has released a fixed build and the issue should be treated as a high-priority patch item.
Use-after-free in Google Chrome's WebAppInstalls (web app / PWA installation) component affects versions prior to 156.0.8078.47 and can let a remote attacker who convinces a victim to open a crafted HTML page potentially execute arbitrary code outside the browser sandbox. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven by the scope change and high confidentiality, integrity and availability impact, although Google assigns only a Medium Chromium security severity and frames code execution as 'potential' because it depends on reliably reclaiming freed memory after the free. No public exploit code or CISA KEV entry was identified at time of analysis, and the mandatory user interaction (UI:R) rules out fully autonomous, unattended exploitation; the vendor-released fix is Chrome 156.0.8078.47.
Remote code execution inside Chrome's renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 through a use-after-free in the Frames component. An unauthenticated remote attacker can trigger the flaw by convincing a victim to load a crafted HTML page (UI:R). Successful exploitation is confined to the renderer sandbox and would require a separate sandbox escape for host compromise; no public exploit code or CISA KEV entry was identified at time of analysis.
Use-after-free in Google Chrome's Permissions component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. No authentication or privileges are required, though exploitation is not zero-click (UI:R) and the resulting code execution is contained within the Chrome sandbox - full host compromise would require chaining a separate sandbox-escape flaw. Chromium rates the bug Low severity, but the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Use-after-free in Google Chrome for Android's CustomTabs component allows a remote attacker to execute arbitrary code inside the sandboxed renderer when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. Google has released a vendor patch in Chrome 156.0.8078.47, and no public exploit identified at time of analysis. Because exploitation requires user interaction and the resulting code execution is confined to the renderer sandbox, compromise of the host device would require chaining a separate sandbox-escape vulnerability.
Use-after-free memory corruption in Google Chrome's Canvas implementation allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47 across desktop and ChromeOS channels. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the target must navigate to or render attacker-controlled content such as a malicious link, compromised site, or injected ad/iframe, and the Canvas path is reachable in default configurations with no special toggle. Impact is bounded by the sandbox - code execution stays within the renderer (S:U) and host-level compromise would require a separate sandbox-escape - and at time of analysis no public exploit code has been identified; enterprise patch cadence, not emergency response, is the driver, and Google rates the flaw Chromium security severity High (CVSS 8.8).
Use-after-free in Google Chrome's PDF handling before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the Chrome sandbox when a victim opens a crafted HTML page. The issue is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) but requires user interaction; Chromium's own severity rating is Low, reflecting that code execution is confined to the sandbox and host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released a fixed build.
Google Chrome before 156.0.8078.47 contains a use-after-free in the ANGLE graphics backend that can be triggered when a user opens a crafted HTML page, potentially allowing code execution inside the renderer sandbox. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but because scope is unchanged, host compromise would require chaining with a separate sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
Use-after-free in the Chromecast component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who persuades a victim to open a crafted HTML page potentially execute arbitrary code - but only inside the browser sandbox, as confirmed by the vendor's own wording. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a high-confidentiality and high-integrity impact that requires user interaction; there is no fully drive-by, zero-interaction path, and no public exploit code or CISA KEV entry was identified at time of analysis. Because code execution stays within the sandbox, host compromise would require a separate sandbox-escape primitive, which is the main factor capping real-world impact.
Use-after-free in Google Chrome on iOS before 156.0.8078.47 enables remote attackers to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the page), and code execution is confined to the sandbox, so full-device compromise would need an additional sandbox escape. Google has released a vendor patch; no public exploit code or active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's Loader component before 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to execute arbitrary code inside the renderer sandbox. Exploitation requires user interaction (UI:R) and no special configuration, but the impact is bounded by Chrome's sandbox; full host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and Google rates the issue Chromium severity Low despite the 8.8 CVSS score.
Heap use-after-free in Google Chrome's Network component allows remote code execution within the browser sandbox: any Chrome build prior to 156.0.8078.47 that renders an attacker-crafted HTML page can trigger memory corruption and achieve code execution at the browser's privilege level. No credentials or privileges are required (PR:N), but exploitation is not zero-click - the victim must navigate to or load the malicious content, as reflected by CVSS UI:R and the vendor's 'crafted HTML page' wording. Chromium rates the issue Medium severity even though the CVSS 3.1 base score computes to 8.8 (C:H/I:H/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the practical ceiling on impact is the Chrome sandbox, which must be escaped separately for host-level compromise.
Use-after-free in Google Chrome's Editing component (all builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is gated entirely by user interaction - the target must visit or open the attacker-supplied page - and the resulting code execution is confined to the Chrome renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug; Google consequently rates the standalone issue as Chromium severity 'Low' even though the generic CVSS 3.1 vector scores 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied, so the practical priority hinges on reconciling the high vector score with the sandbox-limited, interaction-dependent impact.
Arbitrary code execution outside the sandbox is possible in Google Chrome prior to 156.0.8078.47 because of a use-after-free in the V8 JavaScript engine. An unauthenticated remote attacker can lure a victim to a crafted HTML/JavaScript page; successful exploitation can corrupt V8 memory and execute code on the host beyond the renderer sandbox. Google has released 156.0.8078.47 to address it, and no public exploit identified at time of analysis.
Use-after-free in the Google Lens component of Google Chrome versions prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires user interaction (the victim must visit or render attacker-controlled content), and the resulting code execution is confined by Chrome's sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code was identified at the time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
Use-after-free memory corruption in Google Chrome's DataTransfer interface affects builds prior to 156.0.8078.47 and lets a remote attacker execute arbitrary code within the renderer sandbox by convincing a victim to load a crafted HTML page. No public exploit code or confirmed active exploitation is identified in the available intelligence, though the vendor rates the issue Medium severity while the CVSS 3.1 vector scores 8.8 (AV:N/AC:L/PR:N/UI:R/S:U). Because the sandbox confines execution, full host compromise would require chaining an additional sandbox-escape vulnerability, so practical risk centers on renderer-level compromise, data theft from the browsing session, and denial of service.
Remote code execution inside Chrome's renderer sandbox on Android is possible through a use-after-free in the WebAppInstalls component of Google Chrome versions prior to 156.0.8078.47. An unauthenticated remote attacker can deliver a crafted HTML page, but the victim must navigate to or render it (UI:R), and the CVSS 3.1 score is 8.8 with scope unchanged (S:U), so OS-level compromise requires a separate sandbox escape. No public exploit identified at time of analysis; patching to 156.0.8078.47 is the direct fix.
Use-after-free in Google Chrome's Navigation component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), since the target must actively visit the attacker-controlled page, and the resulting code execution is confined to the renderer sandbox - escaping to the host would require an additional sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has released a fixed build (156.0.8078.47), so real-world urgency is lower than the raw 8.8 base score implies.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The vendor rates the issue Low severity, and the independent assessment scores it 6.3 with limited confidentiality, integrity, and availability impact because code execution is confined to the sandbox; no public exploit code or active exploitation has been identified, and a vendor patch is available.
Use-after-free in ANGLE, Chrome's WebGL/graphics translation layer, allows remote attackers to execute arbitrary code inside the renderer sandbox on Windows by luring a victim into opening a crafted HTML page. Exploitation requires user interaction (UI:R) - a page that drives the WebGL/GPU rendering path - and affects Chrome builds on Windows earlier than 156.0.8078.47; unauthenticated remote delivery is possible (PR:N) and default installations are exposed because ANGLE is the standard graphics backend. Code execution is confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw; no public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue High severity with a vendor patch available.
Use-after-free in Google Chrome's ContextualSearch component (all versions prior to 156.0.8078.47) allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a low-complexity, network-reachable flaw whose only prerequisite is victim navigation; however, per the vendor description, the resulting code execution is confined to the renderer sandbox, so host-level compromise requires a separate sandbox-escape vulnerability. Chromium rates this a Medium-severity issue, no public exploit code was identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in Chrome's SiteIsolation component on Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page (UI:R required, PR:N). Only Android builds prior to 156.0.8078.47 are affected; the resulting code execution is confined to the sandboxed renderer, so full device compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor-rated severity combined with a high CVSS (8.8) and a memory-corruption/RCE tag profile makes prompt patching advisable; the vendor has released a fixed build.
Remote code execution inside the renderer sandbox affects Google Chrome builds prior to 156.0.8078.47, where a use-after-free in the Variations component can be triggered by a crafted HTML page. Exploitation requires the victim to navigate to attacker-controlled content (UI:R), but no authentication or special configuration is needed; the resulting code execution is confined to the sandbox, so crossing a security boundary depends on chaining a separate sandbox-escape flaw. No public exploit code was identified at time of analysis.
A use-after-free in Chrome's TrustedWebActivities component on Android allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in Chrome for Android versions prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects an unauthenticated, network-reachable flaw that nevertheless requires user interaction - the victim must navigate to or render attacker-controlled content - so no zero-click path is present in the available data. Successful exploitation yields high-confidentiality, high-integrity code execution confined to the sandboxed renderer process; escaping the sandbox to compromise the underlying Android device would require chaining a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the 8.8 base score.
Use-after-free in Google Chrome's CSS handling lets a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation requires user interaction (CVSS UI:R) - visiting or being redirected to a malicious or compromised page - but no credentials or non-default configuration, since the flaw sits in the default rendering path. The impact is bounded: the description specifies code execution 'inside the sandbox,' so host compromise needs a separate sandbox escape, and no public exploit code or confirmed active exploitation was identified at time of analysis. Google shipped a stable-channel fix in 156.0.8078.47, and Chrome's automatic updater sharply shrinks the exposed population once that build propagates.
Use-after-free in Google Chrome's BrowserTag component, affecting desktop builds prior to 156.0.8078.47, allows remote unauthenticated attackers to execute arbitrary code inside the Chrome renderer sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Because code execution is confined to the renderer sandbox, full host compromise would additionally require a separate sandbox-escape vulnerability, which limits the practical blast radius. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the high base score.
A use-after-free in ANGLE, the graphics translation layer behind Chrome's WebGL and hardware-accelerated canvas rendering, lets a crafted HTML page corrupt renderer memory and achieve arbitrary code execution inside the browser sandbox in Google Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled web content that exercises WebGL paths, and no non-default configuration is needed - the component is enabled by default. Multiple signals align toward genuine priority with one important nuance: code execution is confined to the renderer sandbox, so host compromise would require chaining a separate sandbox escape. At time of analysis, no public exploit code and no confirmed active exploitation (CISA KEV) were identified, though the 8.8 CVSS and RCE-class tagging warrant prompt patching.
Use-after-free in Google Chrome's Extensions subsystem before 156.0.8078.47 lets unauthenticated remote attackers execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page, with high confidentiality and integrity impact under CVSS 8.8. No public exploit identified at time of analysis, and exploitation is constrained by the required user navigation and by the renderer sandbox, so host compromise would require chaining a separate sandbox escape. Google has released a vendor patch in Chrome 156.0.8078.47.
Use-after-free in the Forms component of Google Chrome before 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution, but only inside the renderer sandbox, by convincing a victim to load a crafted HTML page containing malicious form markup or JavaScript. Exploitation requires user interaction (CVSS UI:R) and low complexity, and the CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact within the compromised renderer rather than on the host OS; escaping Chrome would require chaining a separate sandbox-escape flaw. Vendor patch 156.0.8078.47 is available, and no public exploit code or CISA KEV confirmation was identified at time of analysis. Note the reported Medium Chromium severity contrasts with the 8.8 NVD-style vector, which should guide prioritization toward prompt patching rather than emergency response.
Use-after-free in Google Chrome's Internals component on macOS lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, and Google has released Chrome 156.0.8078.47 to fix it. The bug is remotely reachable without credentials but requires the user to open or be redirected to attacker-controlled content (UI:R), is limited to macOS builds, and yields code execution confined to the sandbox - host-level compromise would need a separate sandbox escape, which is why Chrome rates it Medium despite a High 8.8 CVSS. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in targeted phishing or watering-hole delivery against macOS Chrome users.
Use-after-free in Google Chrome's ServiceWorker implementation affects desktop Chrome builds prior to 156.0.8078.47 and can let a remote attacker execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. The issue is rated CVSS 8.8 with UI:R and PR:N, so exploitation depends on user navigation rather than credentials; the code-execution impact is constrained to the sandboxed renderer, and a separate sandbox escape would be needed to compromise the host OS. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Use-after-free in Google Chrome Core before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page, with the required user interaction being the main limiting factor. Default desktop Chrome installations on affected versions are exposed if a user visits the malicious page; successful exploitation crosses the sandbox boundary and can affect the host. Vendor-released patch: 156.0.8078.47, and no public exploit identified at time of analysis.
Use-after-free in Google Chrome's DOM allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction, and the impact is confined to the renderer sandbox unless chained with a separate sandbox-escape flaw; Google rates the issue as Chromium security severity Medium despite the 8.8 CVSS score. Vendor-released patch: 156.0.8078.47, and no public exploit was identified at time of analysis.
Use-after-free in Google Chrome's Navigation component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. Exploitation requires user interaction and, because code execution is confined to the sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation identified at time of analysis, and Google has released a fixed build.
Use-after-free in Chrome's Paint rendering component lets a remote attacker execute arbitrary code inside the renderer sandbox by getting a victim to open a crafted HTML page in any build prior to 156.0.8078.47. No privileges or credentials are needed, but the attacker must convince the user to render the malicious content (CVSS UI:R), and because the score is scoped to the renderer (S:U), full host compromise would additionally require a separate sandbox escape. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor has released a fixed build, so this is a genuine high-priority patch item for browser fleets rather than a theoretical memory-safety bug.
Use-after-free in Google Chrome's FileSystem component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is network-reachable, low-complexity, and unauthenticated (CVSS 3.1 base 8.8, PR:N), but successful exploitation requires user interaction and remains scoped to the sandbox, so host compromise would need a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis; Google has released a vendor patch in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Extensions component allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim opens or is navigated to a crafted HTML page, affecting desktop builds prior to 156.0.8078.47. Google rates the flaw Medium at the Chromium severity level, while the 8.8 CVSS reflects high confidentiality and integrity impact confined to the sandboxed renderer; exploitation requires user interaction (UI:R), and full host compromise needs a separate sandbox escape. No public exploit code was identified at time of analysis, and a vendor patch shipped in the 156.0.8078.47 stable channel update published on the Chrome Releases blog.
Arbitrary code execution inside the Chrome for Android sandbox (versions before 156.0.8078.47) can be triggered by a crafted HTML page that exploits a use-after-free in Autofill. The attacker must persuade the victim to load the page (UI:R), but no authentication is required (PR:N); the resulting code runs within the renderer sandbox unless a separate sandbox-escape vulnerability is chained. No public exploit code has been identified at time of analysis, and Google has released fixed build 156.0.8078.47.
Use-after-free in Google Chrome's Permissions component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The issue requires user interaction (CVSS UI:R), needs no authentication (PR:N), and carries a CVSS 8.8 base score even though Chromium rates its security severity as Low; the described code execution is confined to the renderer sandbox and would require chaining with a separate sandbox escape for host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Core component on macOS allows remote attackers to execute arbitrary code inside the renderer sandbox when a user opens a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction and affects default configurations, but code execution is confined to the Chrome sandbox and cannot reach the host OS without a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis.
Chrome for Android before 156.0.8078.47 carries a high-priority WebGL use-after-free that can let a remote, unauthenticated attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 8.8 vector requires user interaction (UI:R) but no privileges (PR:N), and the Unchanged scope plus the vendor's 'inside the sandbox' wording mean full device compromise would need a separate sandbox-escape chain. No public exploit identified at time of analysis, and Google has released 156.0.8078.47 as the vendor fix.
Remote code execution inside the Chrome renderer sandbox is achievable via a use-after-free condition in the WebRTC implementation of Google Chrome builds prior to 156.0.8078.47. A victim only needs to load a crafted HTML page (UI:R, PR:N per the CVSS vector), and because WebRTC is enabled by default in standard Chrome builds the vulnerable code path is reachable without special configuration. The vendor rates Chromium security severity High, and while code execution is confined to the sandbox - meaning a separate sandbox escape is required for full host compromise - the CVSS 8.8 and confirmed availability of a vendor patch make this a genuine high-priority patching target; no public exploit code has been identified at time of analysis.
Use-after-free in Google Chrome's Turbolev component allows remote attackers to execute arbitrary code inside the renderer sandbox on any desktop or ChromeOS build prior to 156.0.8078.47. Exploitation requires user interaction: the victim must open a crafted HTML page (directly, or via an ad/iframe on a compromised site), but no authentication or non-default configuration is needed, and confidentiality, integrity, and availability impacts are all rated High. Code execution is scope-unchanged and confined to the sandbox, so full host compromise would require chaining a separate sandbox-escape flaw; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Streaming component (fixed in 156.0.8078.47) lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code inside the renderer sandbox. No authentication or pre-existing privileges are required, but exploitation hinges on user interaction - the target must navigate to or render attacker-controlled content - and any code execution stays confined to the renderer, so host compromise requires chaining a separate sandbox escape. Google rates the issue Chromium severity Medium while NVD-compatible scoring lands at 8.8; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Use-after-free in Google Chrome for Android prior to 156.0.8078.47 lets a remote attacker potentially execute code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the user to open attacker-controlled content (UI:R), and the resulting code execution stays confined to Chrome's sandbox - consistent with the vendor's 'Low' Chromium severity rating - so meaningful compromise of the Android device would require chaining a separate sandbox escape. Google has released a fixed build and no public exploit code has been identified at time of analysis, though NVD's base score of 8.8 is materially higher than our assessed vector (C:L/I:L/A:L) because it does not account for sandbox confinement.
Use-after-free in Google Chrome's Glic component (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker (PR:N) to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (UI:R) such as visiting a malicious or compromised site. The impact is scope-unchanged (S:U): code execution is confined to the Chrome renderer sandbox, and achieving host-level compromise would require chaining a separate sandbox-escape vulnerability. Available intelligence shows no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation; Google has released a vendor patch in Chrome 156.0.8078.47.
Google Chrome before 156.0.8078.47 contains a use-after-free in its Transactions Platform that allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction but no privileges or non-default configuration, so default installations are in scope; code execution is sandbox-confined unless chained with a separate sandbox escape. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.
Use-after-free memory corruption in ANGLE, Chrome's OpenGL ES abstraction layer, allows remote attackers to execute arbitrary code inside the renderer sandbox in Google Chrome versions prior to 156.0.8078.47 when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated from the network but requires mandatory user interaction to render the malicious content, and the resulting code execution is contained by Chrome's renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw; Google rates the Chromium security severity as Low, which is consistent with that containment. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied; a vendor patch is available in Chrome 156.0.8078.47.
Google Chrome before 156.0.8078.47 contains a use-after-free in the Actor component that allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and the impact is sandbox-confined rather than host-level code execution unless a separate sandbox escape is chained. The vendor has released Chrome 156.0.8078.47, Chromium rated the issue Low, and no public exploit was identified at time of analysis; the supplied 8.8 base score conflicts with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector.
Use-after-free in Google Chrome's GPU component allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page; all Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires only that a user navigate to attacker-controlled content (no authentication, default configurations exposed). Successful exploitation yields high confidentiality and integrity impact but remains scope-unchanged - code executes inside the renderer/GPU sandbox, so host compromise requires chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium severity as Medium even though the CVSS base score computes to 8.8. A vendor-released patch in Chrome 156.0.8078.47 is available.
Use-after-free in Chrome's Network component on Windows lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the browser sandbox. All Windows Chrome builds prior to 156.0.8078.47 are affected; exploiting it requires user interaction (rendering attacker-controlled content) but no credentials, and the resulting code execution is contained by the sandbox, so full host compromise needs chaining with a separate sandbox escape. Google rates it High severity and a fixed build is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's DevTools component, affecting desktop builds prior to 156.0.8078.47, can potentially allow a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to load a crafted HTML page while an active DevTools session is engaged, so the attack is remote and unauthenticated but gated by user interaction and a non-default browser state - which is why Chromium assigned it a Low security severity while the raw vector scores 9.6 and our independent assessment lowers it to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Transactions Platform lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 156.0.8078.47. Exploitation is unauthenticated per the CVSS vector (PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and because scope is Unchanged the resulting code execution is confined to the sandbox - full host compromise would require chaining a separate sandbox escape. Severity signals conflict and should temper the headline score: NVD-style scoring yields 8.8 while Google rates this Chromium severity Medium, and no CISA KEV listing or public exploit code was identified at time of analysis, so the practical risk is best framed as a high-impact but interaction-gated memory-corruption primitive rather than a confirmed actively exploited threat.
Use-after-free in Google Chrome's SignIn component before version 156.0.8078.47 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. Exploitation requires user interaction (UI:R) and remains bounded by Chrome's sandbox, so host compromise would require a separate sandbox-escape vulnerability; Google rates the Chromium security severity as Low despite a CVSS score of 8.8. No public exploit or CISA KEV listing was identified at time of analysis, and a vendor patch is available.
Use-after-free in Google Chrome's Extensions subsystem enables remote code execution inside the renderer sandbox when a victim opens attacker-controlled crafted HTML, affecting desktop builds prior to 156.0.8078.47. The attack is unauthenticated over the network but requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), the code execution is contained by the browser sandbox - full host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) on record; risk is moderated by Chrome's auto-update cadence, since users already on 156.0.8078.47 or later are not exploitable.
Use-after-free in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page execute arbitrary code within the renderer sandbox. The CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact, but per Google (Chromium severity: Medium) code execution is contained inside the sandbox, so host compromise requires chaining a separate sandbox-escape flaw; no authentication is needed but user interaction is mandatory. No public exploit code or confirmed active exploitation was identified at time of analysis, and users on auto-updating channels are remediated without manual action.
Use-after-free in Google Chrome's compositing component enables remote code execution inside the browser sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47. The CVSS vector indicates unauthenticated network access but requires user interaction (UI:R), and the description limits impact to code execution inside the sandbox rather than host escape without a separate sandbox-escape flaw. No public exploit code was identified at time of analysis; Google has released Chrome 156.0.8078.47 as the vendor fix, and risk is tempered by sandbox containment and the need to lure a user to attacker-controlled HTML.
Stale arm64 TLB entries in Zephyr RTOS 4.3.0 through 4.4.2 let an unprivileged user thread (CVSS PR:L, local access) retain read/write mappings to a physical page frame after the demand paging eviction algorithm has reclaimed and reissued that frame to the kernel or to another memory domain. Because the single-VA invalidation only ever matched ASID 0 and global entries, a domain-private non-global leaf created for a k_mem_partition or a user thread stack survives page-out, enabling information disclosure and memory corruption that breaks CONFIG_USERSPACE isolation with scope-changing impact beyond the vulnerable component. Exploitation requires an arm64 build with both CONFIG_USERSPACE and the experimental CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain; the attacker must already be running user-mode code and must drive memory pressure to force eviction and immediate frame reuse (AC:H). No public exploit code or PoC reference was identified in the available sources and the issue is not listed in CISA KEV; vendor fix commits are merged upstream on main with a projected fixed version of 4.5.0, while branch backports remain open.
A heap use-after-free in OpenWrt's odhcpd DHCPv6 IA handler allows an unauthenticated client on the same local link or an adjacent IPv6 network to crash or corrupt the router's DHCPv6/RA daemon. The flaw lives in the per-message `first` lease pointer used to reuse a Reconfigure authentication key across multiple IA options: a REQUEST that binds one IA, then fails the on-link check on a later IA with the same IAID, frees the lease that `first` still references, and a subsequent IA copies 16 bytes from that freed chunk into a new lease's key. The validated impact is adjacent-network denial of service plus Reconfigure/ForceRenew key confusion (deterministically an all-zero key under the traced reclaim pattern); arbitrary code execution is not proven for this UAF alone, and a public maintainer reproduction bundle demonstrates the crash under ASan. It is not confirmed actively exploited (no CISA KEV listing), but it carries a 'this_week' priority and affects essentially every OpenWrt release from 18.06 through the 25.12 package pin.
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
Denial of service in NLnet Labs Unbound versions 1.22.0 through 1.26.1, where a remote DNS-over-QUIC client can crash the resolver by triggering a QUIC path migration at the moment a mesh reply still holds a pointer to the associated DoQ stream. The resulting use-after-free dereferences the freed stream when the pending reply completes, terminating the process and interrupting DNS resolution for all clients of that instance. Exploitation is race-dependent and only possible when DoQ is enabled and Unbound runs multi-threaded; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but bounded availability risk rather than a wormable or data-exposing flaw.
Code execution can occur in sharp versions before 0.35.5 when an application decodes attacker-supplied SVG images through the bundled librsvg, which contains the use-after-free tracked as CVE-2026-96889. The RCE outcome is constrained to glibc-based Linux and Node.js executables that are not built as PIE, so many distribution-packaged Node.js deployments are protected from code execution even though the underlying memory corruption remains. No public exploit was identified at time of analysis; SVG decoding can be disabled with sharp.block as a workaround.
Denial of service in FreeRDP 3.32.0: a use-after-free in the drdynvc dynamic virtual channel allows a malicious RDP server to crash the client during teardown by sending one crafted Virtual Channel PDU with a totalLength smaller than the chunk size. The victim must initiate an RDP session to the attacker-controlled or compromised server (UI:P), so passive clients are not exposed; the assessed impact is availability-only with no confidentiality or integrity loss. No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV.
Unauthenticated remote code execution in PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12 arises when an attacker drives a worker into an out-of-memory condition while request memory is only partially initialized, leaving freed/reused structures that the request shutdown path then processes. Exploitation is confirmed practical against Apache mod_php with default input and memory limits in normal multi-worker prefork setups, and publicly available exploit code exists; the vendor and distros (Ubuntu USN-8948-1) have released fixed builds. With a 9.2 CVSS score, a public PoC, and an act_now priority decision, this warrants immediate patching, though reliability varies with build, extensions, frontend behavior and allocator layout, and no complete PHP-FPM exploit has been demonstrated.
Use-after-free in PHP's per-request global state handling lets unauthenticated remote attackers achieve arbitrary code execution against persistent workers that reuse memory across requests - PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. Exploitation is high complexity (CVSS:4.0 9.2 with AC:H/AT:P): it needs a 'producer' operation that leaves request-owned state published after an interruption such as a fatal error, uncaught exception, timeout or OOM, followed by a later request to the same worker whose early operation consumes the stale pointer before normal initialization resets it. The vendor documents a confirmed mod_php RCE path (PHP 8.5 with fatal_error_backtraces enabled) and a confirmed session upload progress lifecycle; a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none, and the priority decision is act_now because affected PHP branches are patched and technical impact is total.
Use-after-free in Google Chrome's Performance component (all desktop builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact, but exploitation requires the user to actively visit or render attacker-controlled content and, per Google's advisory, code execution is confined to the Chrome sandbox - host-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in SVG rendering in Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 with UI:R, so exploitation requires user interaction such as visiting attacker-controlled content; no public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Turbolev component affects versions prior to 156.0.8078.47 and lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (the victim must visit or render the malicious page), and successful code execution is confined to the sandbox; host compromise would require chaining a separate sandbox-escape flaw. Google rates this High severity (CVSS 8.8), and no public exploit was identified at time of analysis, though a vendor patch is available.
Use-after-free in Google Chrome's Chromecast component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page on any build prior to 156.0.8078.47. Exploitation is not passive: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms mandatory user interaction, and the impact is bounded by Chrome's renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape flaw. Priority signals conflict - Chromium rates the issue Medium while the derived CVSS is 8.8 - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security contact and restricts technical detail in the tracker.
Use-after-free in Chrome's GPU process lets remote attackers achieve code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires user interaction (UI:R) with no authentication needed (PR:N), though the code execution is confined to the GPU process sandbox (S:U) unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Use-after-free memory corruption in Google Chrome for iOS prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attacker needs no credentials but must convince the target to open a malicious page, and any resulting code execution stays confined to the Chrome sandbox on iOS - escaping to the underlying device would require a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the risk picture is mixed: Google's Chromium team rates the flaw Low severity, while the CVSS 3.1 base score computes to 8.8 because of the high confidentiality, integrity and availability impact assumed for successful code execution; a vendor patch (156.0.8078.47) is available, so prioritization should weigh the Low vendor rating against the 8.8 vector rather than treating either signal as authoritative.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page corrupt memory and execute arbitrary code inside the renderer sandbox, and can additionally crash the browser. Exploitation is not passive: it requires the target to load attacker-controlled web content, and because the CVSS scope is Unchanged, code execution stays confined to the sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though Chrome renderer memory-corruption bugs are historically attractive to exploit developers; the risk picture is mixed, with Chromium's own severity rating of Medium sitting well below the 8.8 CVSS score derived from the high confidentiality and integrity impact.
Code execution inside the renderer sandbox is possible in Google Chrome builds prior to 156.0.8078.47 because of a use-after-free in the Accessibility component. A remote, unauthenticated attacker can trigger the flaw with a crafted HTML page, but exploitation requires the victim to visit attacker-controlled or attacker-injected content (UI:R), and the resulting code execution remains confined to the renderer sandbox unless chained with a separate sandbox escape. The vendor has released Chrome 156.0.8078.47 to fix the issue; no public exploit was identified at time of analysis.
Code execution inside Google Chrome's renderer sandbox is possible before version 156.0.8078.47 because of a use-after-free in the Media component that is triggered when a victim loads a crafted HTML page. The issue is unauthenticated from the attacker's perspective but requires user interaction (the victim must open the page), and the assessed CVSS vector scores it 8.8 with Scope:Unchanged, meaning compromise is confined to the sandbox unless a separate sandbox-escape flaw is chained. No public exploit was identified at time of analysis, and Google has released a fixed build, 156.0.8078.47; note that Chromium rated the bug Low severity while the CVSS score is High, a conflict that should inform risk decisions.
Use-after-free in Chrome's ServiceWorker implementation allows a remote, unauthenticated attacker to run arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page that registers or manipulates a ServiceWorker, affecting Chrome builds prior to 156.0.8078.47. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high confidentiality, integrity, and availability impact, it scores 8.8, yet Google rates the issue only Medium - the description explicitly scopes the code execution to 'inside the sandbox,' so host or OS compromise requires chaining a separate sandbox-escape flaw. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad browser install base make this a genuine patch-priority item; note that exploitation requires user interaction (the victim must navigate to or render attacker-controlled content).
Google Chrome before 156.0.8078.47 contains a use-after-free in the Core component that can lead to arbitrary code execution inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R (score 8.8), so no authentication is required, but user interaction is the gating condition and the code execution is sandbox-confined unless chained with a separate escape. No public exploit code was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Privacy component lets a remote attacker execute arbitrary code inside the renderer sandbox on any build prior to 156.0.8078.47, triggered simply by getting the victim to load a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R, scope unchanged). The flaw is a heap memory-lifetime corruption issue (CWE-416) whose realistic outcomes are renderer-level code execution or a browser crash/denial of service; escaping to the host operating system would require chaining a separate sandbox-escape bug, and Chrome's automatic updater rapidly shrinks the exposed population once the stable fix lands. Google shipped 156.0.8078.47 as the patched stable release, tracked as Chromium issue 558464760 and rated High by the Chromium security team; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Use-after-free memory corruption in Google Chrome's Extensions component (all versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to load a crafted HTML page run arbitrary code inside the browser sandbox; no authentication or prior privileges are required, but the victim must actively render attacker-controlled content (UI:R), and the resulting execution is confined to the sandbox. Rated 8.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H, CWE-416) with Chromium severity Medium - the gap reflects the sandbox boundary, which an attacker would need a separate escape to cross. No public exploit code and no CISA KEV listing were identified at time of analysis; a vendor patch is available.
Sandboxed remote code execution in Google Chrome prior to 156.0.8078.47 is caused by a use-after-free in the Transactions Platform component and is reachable when a victim loads a crafted HTML page. The issue is unauthenticated and low-complexity but requires user interaction, and code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. Multiple signals make this a genuine but not emergency-tier priority: a vendor patch is available, and no public exploit identified at time of analysis.
Use-after-free in ANGLE, the WebGL/GPU translation layer shipped with Google Chrome on Windows, allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. The CVSS 3.1 vector (8.8 High, AV:N/AC:L/PR:N/UI:R) reflects an unauthenticated, low-complexity attack that hinges only on the user visiting attacker-controlled content, a routine browsing action, though the CVSS integrity/availability impact is scored independently of the sandbox boundary that actually contains the payload. Google rates the underlying Chromium issue High severity; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but browser memory-corruption bugs of this class are routinely chained with a separate sandbox escape for full host compromise.
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page (CVSS 8.8, UI:R). The raw score is high, but the independent assessment notes that code execution is confined to the renderer; full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or CISA KEV entry was identified at time of analysis, so risk signals are mixed and should be weighed with the user-interaction and sandbox constraints.
Google Chrome before 156.0.8078.47 contains a use-after-free in its Prompts component that can be triggered when a user opens crafted HTML content, allowing arbitrary code execution within the renderer sandbox. The CVSS vector indicates a remote, unauthenticated attack with required user interaction and high confidentiality, integrity, and availability impact, although Google rates the Chromium severity as Low and host-level compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the flaw.
Arbitrary code execution inside the Chrome renderer sandbox on macOS is possible with Google Chrome versions prior to 156.0.8078.47 when a user opens a crafted HTML page. The flaw is a use-after-free in Views rated CVSS 3.1 8.8 (High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requiring user interaction but no authentication; code execution is confined to the renderer unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
A use-after-free in Google Chrome's Extensions component (CWE-416) affects all builds prior to 156.0.8078.47 and lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting low complexity and no authentication requirement but a mandatory user-interaction step; impact is confined to the sandbox, so host-level compromise would require chaining a separate sandbox escape. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Google rates the Chromium security severity as Medium.
Use-after-free in Google Chrome's API layer prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (8.8) confirms network reachability and no privileges required, but exploitation is not zero-click: it requires user interaction to render the crafted page, and the impact is scope-limited to Chrome's sandbox (S:U). Google has released a fixed build, and no public exploit code was identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the ReadingMode component of Google Chrome builds prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and Google's own Chromium severity rating for this issue is Low - a sharp conflict with the 8.8 base score that materially changes how the risk should be weighed. Because the description confines the code execution to the sandbox, a complete host compromise would require chaining a separate sandbox-escape bug that this CVE does not supply; no public exploit was identified at the time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Accessibility component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit was identified at time of analysis. Google rates the Chromium security severity Critical, and affected users should update to 156.0.8078.47.
Use-after-free in Google Chrome's Internals component before 156.0.8078.47 allows a remote attacker to escape the browser sandbox and execute arbitrary code when a victim loads a crafted HTML page. The flaw is unauthenticated from the attacker's perspective but requires victim interaction (UI:R), and the scope change plus high confidentiality, integrity, and availability impact produce a Critical 9.6 base score. No public exploit code or confirmed active exploitation was identified at time of analysis; Google has released the fixed 156.0.8078.47 build.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 (Critical), driven by the scope change reflecting a sandbox escape, although Chromium rates the flaw Medium and the vendor describes code execution outside the sandbox as potential. Exploitation requires user interaction to load the crafted page; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 lets unauthenticated remote attackers potentially execute arbitrary code inside the Chrome sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R), and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining with a separate sandbox escape. No public exploit was identified at time of analysis, but the vendor has released a fixed build and the issue should be treated as a high-priority patch item.
Use-after-free in Google Chrome's WebAppInstalls (web app / PWA installation) component affects versions prior to 156.0.8078.47 and can let a remote attacker who convinces a victim to open a crafted HTML page potentially execute arbitrary code outside the browser sandbox. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven by the scope change and high confidentiality, integrity and availability impact, although Google assigns only a Medium Chromium security severity and frames code execution as 'potential' because it depends on reliably reclaiming freed memory after the free. No public exploit code or CISA KEV entry was identified at time of analysis, and the mandatory user interaction (UI:R) rules out fully autonomous, unattended exploitation; the vendor-released fix is Chrome 156.0.8078.47.
Remote code execution inside Chrome's renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 through a use-after-free in the Frames component. An unauthenticated remote attacker can trigger the flaw by convincing a victim to load a crafted HTML page (UI:R). Successful exploitation is confined to the renderer sandbox and would require a separate sandbox escape for host compromise; no public exploit code or CISA KEV entry was identified at time of analysis.
Use-after-free in Google Chrome's Permissions component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. No authentication or privileges are required, though exploitation is not zero-click (UI:R) and the resulting code execution is contained within the Chrome sandbox - full host compromise would require chaining a separate sandbox-escape flaw. Chromium rates the bug Low severity, but the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Use-after-free in Google Chrome for Android's CustomTabs component allows a remote attacker to execute arbitrary code inside the sandboxed renderer when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. Google has released a vendor patch in Chrome 156.0.8078.47, and no public exploit identified at time of analysis. Because exploitation requires user interaction and the resulting code execution is confined to the renderer sandbox, compromise of the host device would require chaining a separate sandbox-escape vulnerability.
Use-after-free memory corruption in Google Chrome's Canvas implementation allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47 across desktop and ChromeOS channels. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the target must navigate to or render attacker-controlled content such as a malicious link, compromised site, or injected ad/iframe, and the Canvas path is reachable in default configurations with no special toggle. Impact is bounded by the sandbox - code execution stays within the renderer (S:U) and host-level compromise would require a separate sandbox-escape - and at time of analysis no public exploit code has been identified; enterprise patch cadence, not emergency response, is the driver, and Google rates the flaw Chromium security severity High (CVSS 8.8).
Use-after-free in Google Chrome's PDF handling before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the Chrome sandbox when a victim opens a crafted HTML page. The issue is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) but requires user interaction; Chromium's own severity rating is Low, reflecting that code execution is confined to the sandbox and host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released a fixed build.
Google Chrome before 156.0.8078.47 contains a use-after-free in the ANGLE graphics backend that can be triggered when a user opens a crafted HTML page, potentially allowing code execution inside the renderer sandbox. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but because scope is unchanged, host compromise would require chaining with a separate sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
Use-after-free in the Chromecast component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who persuades a victim to open a crafted HTML page potentially execute arbitrary code - but only inside the browser sandbox, as confirmed by the vendor's own wording. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a high-confidentiality and high-integrity impact that requires user interaction; there is no fully drive-by, zero-interaction path, and no public exploit code or CISA KEV entry was identified at time of analysis. Because code execution stays within the sandbox, host compromise would require a separate sandbox-escape primitive, which is the main factor capping real-world impact.
Use-after-free in Google Chrome on iOS before 156.0.8078.47 enables remote attackers to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the page), and code execution is confined to the sandbox, so full-device compromise would need an additional sandbox escape. Google has released a vendor patch; no public exploit code or active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's Loader component before 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to execute arbitrary code inside the renderer sandbox. Exploitation requires user interaction (UI:R) and no special configuration, but the impact is bounded by Chrome's sandbox; full host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and Google rates the issue Chromium severity Low despite the 8.8 CVSS score.
Heap use-after-free in Google Chrome's Network component allows remote code execution within the browser sandbox: any Chrome build prior to 156.0.8078.47 that renders an attacker-crafted HTML page can trigger memory corruption and achieve code execution at the browser's privilege level. No credentials or privileges are required (PR:N), but exploitation is not zero-click - the victim must navigate to or load the malicious content, as reflected by CVSS UI:R and the vendor's 'crafted HTML page' wording. Chromium rates the issue Medium severity even though the CVSS 3.1 base score computes to 8.8 (C:H/I:H/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the practical ceiling on impact is the Chrome sandbox, which must be escaped separately for host-level compromise.
Use-after-free in Google Chrome's Editing component (all builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is gated entirely by user interaction - the target must visit or open the attacker-supplied page - and the resulting code execution is confined to the Chrome renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug; Google consequently rates the standalone issue as Chromium severity 'Low' even though the generic CVSS 3.1 vector scores 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied, so the practical priority hinges on reconciling the high vector score with the sandbox-limited, interaction-dependent impact.
Arbitrary code execution outside the sandbox is possible in Google Chrome prior to 156.0.8078.47 because of a use-after-free in the V8 JavaScript engine. An unauthenticated remote attacker can lure a victim to a crafted HTML/JavaScript page; successful exploitation can corrupt V8 memory and execute code on the host beyond the renderer sandbox. Google has released 156.0.8078.47 to address it, and no public exploit identified at time of analysis.
Use-after-free in the Google Lens component of Google Chrome versions prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires user interaction (the victim must visit or render attacker-controlled content), and the resulting code execution is confined by Chrome's sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code was identified at the time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
Use-after-free memory corruption in Google Chrome's DataTransfer interface affects builds prior to 156.0.8078.47 and lets a remote attacker execute arbitrary code within the renderer sandbox by convincing a victim to load a crafted HTML page. No public exploit code or confirmed active exploitation is identified in the available intelligence, though the vendor rates the issue Medium severity while the CVSS 3.1 vector scores 8.8 (AV:N/AC:L/PR:N/UI:R/S:U). Because the sandbox confines execution, full host compromise would require chaining an additional sandbox-escape vulnerability, so practical risk centers on renderer-level compromise, data theft from the browsing session, and denial of service.
Remote code execution inside Chrome's renderer sandbox on Android is possible through a use-after-free in the WebAppInstalls component of Google Chrome versions prior to 156.0.8078.47. An unauthenticated remote attacker can deliver a crafted HTML page, but the victim must navigate to or render it (UI:R), and the CVSS 3.1 score is 8.8 with scope unchanged (S:U), so OS-level compromise requires a separate sandbox escape. No public exploit identified at time of analysis; patching to 156.0.8078.47 is the direct fix.
Use-after-free in Google Chrome's Navigation component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), since the target must actively visit the attacker-controlled page, and the resulting code execution is confined to the renderer sandbox - escaping to the host would require an additional sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has released a fixed build (156.0.8078.47), so real-world urgency is lower than the raw 8.8 base score implies.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The vendor rates the issue Low severity, and the independent assessment scores it 6.3 with limited confidentiality, integrity, and availability impact because code execution is confined to the sandbox; no public exploit code or active exploitation has been identified, and a vendor patch is available.
Use-after-free in ANGLE, Chrome's WebGL/graphics translation layer, allows remote attackers to execute arbitrary code inside the renderer sandbox on Windows by luring a victim into opening a crafted HTML page. Exploitation requires user interaction (UI:R) - a page that drives the WebGL/GPU rendering path - and affects Chrome builds on Windows earlier than 156.0.8078.47; unauthenticated remote delivery is possible (PR:N) and default installations are exposed because ANGLE is the standard graphics backend. Code execution is confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw; no public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue High severity with a vendor patch available.
Use-after-free in Google Chrome's ContextualSearch component (all versions prior to 156.0.8078.47) allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a low-complexity, network-reachable flaw whose only prerequisite is victim navigation; however, per the vendor description, the resulting code execution is confined to the renderer sandbox, so host-level compromise requires a separate sandbox-escape vulnerability. Chromium rates this a Medium-severity issue, no public exploit code was identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in Chrome's SiteIsolation component on Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page (UI:R required, PR:N). Only Android builds prior to 156.0.8078.47 are affected; the resulting code execution is confined to the sandboxed renderer, so full device compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor-rated severity combined with a high CVSS (8.8) and a memory-corruption/RCE tag profile makes prompt patching advisable; the vendor has released a fixed build.
Remote code execution inside the renderer sandbox affects Google Chrome builds prior to 156.0.8078.47, where a use-after-free in the Variations component can be triggered by a crafted HTML page. Exploitation requires the victim to navigate to attacker-controlled content (UI:R), but no authentication or special configuration is needed; the resulting code execution is confined to the sandbox, so crossing a security boundary depends on chaining a separate sandbox-escape flaw. No public exploit code was identified at time of analysis.
A use-after-free in Chrome's TrustedWebActivities component on Android allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in Chrome for Android versions prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects an unauthenticated, network-reachable flaw that nevertheless requires user interaction - the victim must navigate to or render attacker-controlled content - so no zero-click path is present in the available data. Successful exploitation yields high-confidentiality, high-integrity code execution confined to the sandboxed renderer process; escaping the sandbox to compromise the underlying Android device would require chaining a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the 8.8 base score.
Use-after-free in Google Chrome's CSS handling lets a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation requires user interaction (CVSS UI:R) - visiting or being redirected to a malicious or compromised page - but no credentials or non-default configuration, since the flaw sits in the default rendering path. The impact is bounded: the description specifies code execution 'inside the sandbox,' so host compromise needs a separate sandbox escape, and no public exploit code or confirmed active exploitation was identified at time of analysis. Google shipped a stable-channel fix in 156.0.8078.47, and Chrome's automatic updater sharply shrinks the exposed population once that build propagates.
Use-after-free in Google Chrome's BrowserTag component, affecting desktop builds prior to 156.0.8078.47, allows remote unauthenticated attackers to execute arbitrary code inside the Chrome renderer sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Because code execution is confined to the renderer sandbox, full host compromise would additionally require a separate sandbox-escape vulnerability, which limits the practical blast radius. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the high base score.
A use-after-free in ANGLE, the graphics translation layer behind Chrome's WebGL and hardware-accelerated canvas rendering, lets a crafted HTML page corrupt renderer memory and achieve arbitrary code execution inside the browser sandbox in Google Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled web content that exercises WebGL paths, and no non-default configuration is needed - the component is enabled by default. Multiple signals align toward genuine priority with one important nuance: code execution is confined to the renderer sandbox, so host compromise would require chaining a separate sandbox escape. At time of analysis, no public exploit code and no confirmed active exploitation (CISA KEV) were identified, though the 8.8 CVSS and RCE-class tagging warrant prompt patching.
Use-after-free in Google Chrome's Extensions subsystem before 156.0.8078.47 lets unauthenticated remote attackers execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page, with high confidentiality and integrity impact under CVSS 8.8. No public exploit identified at time of analysis, and exploitation is constrained by the required user navigation and by the renderer sandbox, so host compromise would require chaining a separate sandbox escape. Google has released a vendor patch in Chrome 156.0.8078.47.
Use-after-free in the Forms component of Google Chrome before 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution, but only inside the renderer sandbox, by convincing a victim to load a crafted HTML page containing malicious form markup or JavaScript. Exploitation requires user interaction (CVSS UI:R) and low complexity, and the CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact within the compromised renderer rather than on the host OS; escaping Chrome would require chaining a separate sandbox-escape flaw. Vendor patch 156.0.8078.47 is available, and no public exploit code or CISA KEV confirmation was identified at time of analysis. Note the reported Medium Chromium severity contrasts with the 8.8 NVD-style vector, which should guide prioritization toward prompt patching rather than emergency response.
Use-after-free in Google Chrome's Internals component on macOS lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, and Google has released Chrome 156.0.8078.47 to fix it. The bug is remotely reachable without credentials but requires the user to open or be redirected to attacker-controlled content (UI:R), is limited to macOS builds, and yields code execution confined to the sandbox - host-level compromise would need a separate sandbox escape, which is why Chrome rates it Medium despite a High 8.8 CVSS. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in targeted phishing or watering-hole delivery against macOS Chrome users.
Use-after-free in Google Chrome's ServiceWorker implementation affects desktop Chrome builds prior to 156.0.8078.47 and can let a remote attacker execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. The issue is rated CVSS 8.8 with UI:R and PR:N, so exploitation depends on user navigation rather than credentials; the code-execution impact is constrained to the sandboxed renderer, and a separate sandbox escape would be needed to compromise the host OS. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Use-after-free in Google Chrome Core before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page, with the required user interaction being the main limiting factor. Default desktop Chrome installations on affected versions are exposed if a user visits the malicious page; successful exploitation crosses the sandbox boundary and can affect the host. Vendor-released patch: 156.0.8078.47, and no public exploit identified at time of analysis.
Use-after-free in Google Chrome's DOM allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction, and the impact is confined to the renderer sandbox unless chained with a separate sandbox-escape flaw; Google rates the issue as Chromium security severity Medium despite the 8.8 CVSS score. Vendor-released patch: 156.0.8078.47, and no public exploit was identified at time of analysis.
Use-after-free in Google Chrome's Navigation component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. Exploitation requires user interaction and, because code execution is confined to the sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation identified at time of analysis, and Google has released a fixed build.
Use-after-free in Chrome's Paint rendering component lets a remote attacker execute arbitrary code inside the renderer sandbox by getting a victim to open a crafted HTML page in any build prior to 156.0.8078.47. No privileges or credentials are needed, but the attacker must convince the user to render the malicious content (CVSS UI:R), and because the score is scoped to the renderer (S:U), full host compromise would additionally require a separate sandbox escape. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor has released a fixed build, so this is a genuine high-priority patch item for browser fleets rather than a theoretical memory-safety bug.
Use-after-free in Google Chrome's FileSystem component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is network-reachable, low-complexity, and unauthenticated (CVSS 3.1 base 8.8, PR:N), but successful exploitation requires user interaction and remains scoped to the sandbox, so host compromise would need a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis; Google has released a vendor patch in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Extensions component allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim opens or is navigated to a crafted HTML page, affecting desktop builds prior to 156.0.8078.47. Google rates the flaw Medium at the Chromium severity level, while the 8.8 CVSS reflects high confidentiality and integrity impact confined to the sandboxed renderer; exploitation requires user interaction (UI:R), and full host compromise needs a separate sandbox escape. No public exploit code was identified at time of analysis, and a vendor patch shipped in the 156.0.8078.47 stable channel update published on the Chrome Releases blog.
Arbitrary code execution inside the Chrome for Android sandbox (versions before 156.0.8078.47) can be triggered by a crafted HTML page that exploits a use-after-free in Autofill. The attacker must persuade the victim to load the page (UI:R), but no authentication is required (PR:N); the resulting code runs within the renderer sandbox unless a separate sandbox-escape vulnerability is chained. No public exploit code has been identified at time of analysis, and Google has released fixed build 156.0.8078.47.
Use-after-free in Google Chrome's Permissions component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The issue requires user interaction (CVSS UI:R), needs no authentication (PR:N), and carries a CVSS 8.8 base score even though Chromium rates its security severity as Low; the described code execution is confined to the renderer sandbox and would require chaining with a separate sandbox escape for host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Core component on macOS allows remote attackers to execute arbitrary code inside the renderer sandbox when a user opens a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction and affects default configurations, but code execution is confined to the Chrome sandbox and cannot reach the host OS without a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis.
Chrome for Android before 156.0.8078.47 carries a high-priority WebGL use-after-free that can let a remote, unauthenticated attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 8.8 vector requires user interaction (UI:R) but no privileges (PR:N), and the Unchanged scope plus the vendor's 'inside the sandbox' wording mean full device compromise would need a separate sandbox-escape chain. No public exploit identified at time of analysis, and Google has released 156.0.8078.47 as the vendor fix.
Remote code execution inside the Chrome renderer sandbox is achievable via a use-after-free condition in the WebRTC implementation of Google Chrome builds prior to 156.0.8078.47. A victim only needs to load a crafted HTML page (UI:R, PR:N per the CVSS vector), and because WebRTC is enabled by default in standard Chrome builds the vulnerable code path is reachable without special configuration. The vendor rates Chromium security severity High, and while code execution is confined to the sandbox - meaning a separate sandbox escape is required for full host compromise - the CVSS 8.8 and confirmed availability of a vendor patch make this a genuine high-priority patching target; no public exploit code has been identified at time of analysis.
Use-after-free in Google Chrome's Turbolev component allows remote attackers to execute arbitrary code inside the renderer sandbox on any desktop or ChromeOS build prior to 156.0.8078.47. Exploitation requires user interaction: the victim must open a crafted HTML page (directly, or via an ad/iframe on a compromised site), but no authentication or non-default configuration is needed, and confidentiality, integrity, and availability impacts are all rated High. Code execution is scope-unchanged and confined to the sandbox, so full host compromise would require chaining a separate sandbox-escape flaw; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Streaming component (fixed in 156.0.8078.47) lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code inside the renderer sandbox. No authentication or pre-existing privileges are required, but exploitation hinges on user interaction - the target must navigate to or render attacker-controlled content - and any code execution stays confined to the renderer, so host compromise requires chaining a separate sandbox escape. Google rates the issue Chromium severity Medium while NVD-compatible scoring lands at 8.8; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Use-after-free in Google Chrome for Android prior to 156.0.8078.47 lets a remote attacker potentially execute code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the user to open attacker-controlled content (UI:R), and the resulting code execution stays confined to Chrome's sandbox - consistent with the vendor's 'Low' Chromium severity rating - so meaningful compromise of the Android device would require chaining a separate sandbox escape. Google has released a fixed build and no public exploit code has been identified at time of analysis, though NVD's base score of 8.8 is materially higher than our assessed vector (C:L/I:L/A:L) because it does not account for sandbox confinement.
Use-after-free in Google Chrome's Glic component (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker (PR:N) to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (UI:R) such as visiting a malicious or compromised site. The impact is scope-unchanged (S:U): code execution is confined to the Chrome renderer sandbox, and achieving host-level compromise would require chaining a separate sandbox-escape vulnerability. Available intelligence shows no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation; Google has released a vendor patch in Chrome 156.0.8078.47.
Google Chrome before 156.0.8078.47 contains a use-after-free in its Transactions Platform that allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction but no privileges or non-default configuration, so default installations are in scope; code execution is sandbox-confined unless chained with a separate sandbox escape. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.
Use-after-free memory corruption in ANGLE, Chrome's OpenGL ES abstraction layer, allows remote attackers to execute arbitrary code inside the renderer sandbox in Google Chrome versions prior to 156.0.8078.47 when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated from the network but requires mandatory user interaction to render the malicious content, and the resulting code execution is contained by Chrome's renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw; Google rates the Chromium security severity as Low, which is consistent with that containment. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied; a vendor patch is available in Chrome 156.0.8078.47.
Google Chrome before 156.0.8078.47 contains a use-after-free in the Actor component that allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and the impact is sandbox-confined rather than host-level code execution unless a separate sandbox escape is chained. The vendor has released Chrome 156.0.8078.47, Chromium rated the issue Low, and no public exploit was identified at time of analysis; the supplied 8.8 base score conflicts with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector.
Use-after-free in Google Chrome's GPU component allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page; all Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires only that a user navigate to attacker-controlled content (no authentication, default configurations exposed). Successful exploitation yields high confidentiality and integrity impact but remains scope-unchanged - code executes inside the renderer/GPU sandbox, so host compromise requires chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium severity as Medium even though the CVSS base score computes to 8.8. A vendor-released patch in Chrome 156.0.8078.47 is available.
Use-after-free in Chrome's Network component on Windows lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the browser sandbox. All Windows Chrome builds prior to 156.0.8078.47 are affected; exploiting it requires user interaction (rendering attacker-controlled content) but no credentials, and the resulting code execution is contained by the sandbox, so full host compromise needs chaining with a separate sandbox escape. Google rates it High severity and a fixed build is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's DevTools component, affecting desktop builds prior to 156.0.8078.47, can potentially allow a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to load a crafted HTML page while an active DevTools session is engaged, so the attack is remote and unauthenticated but gated by user interaction and a non-default browser state - which is why Chromium assigned it a Low security severity while the raw vector scores 9.6 and our independent assessment lowers it to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Transactions Platform lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 156.0.8078.47. Exploitation is unauthenticated per the CVSS vector (PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and because scope is Unchanged the resulting code execution is confined to the sandbox - full host compromise would require chaining a separate sandbox escape. Severity signals conflict and should temper the headline score: NVD-style scoring yields 8.8 while Google rates this Chromium severity Medium, and no CISA KEV listing or public exploit code was identified at time of analysis, so the practical risk is best framed as a high-impact but interaction-gated memory-corruption primitive rather than a confirmed actively exploited threat.
Use-after-free in Google Chrome's SignIn component before version 156.0.8078.47 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. Exploitation requires user interaction (UI:R) and remains bounded by Chrome's sandbox, so host compromise would require a separate sandbox-escape vulnerability; Google rates the Chromium security severity as Low despite a CVSS score of 8.8. No public exploit or CISA KEV listing was identified at time of analysis, and a vendor patch is available.
Use-after-free in Google Chrome's Extensions subsystem enables remote code execution inside the renderer sandbox when a victim opens attacker-controlled crafted HTML, affecting desktop builds prior to 156.0.8078.47. The attack is unauthenticated over the network but requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), the code execution is contained by the browser sandbox - full host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) on record; risk is moderated by Chrome's auto-update cadence, since users already on 156.0.8078.47 or later are not exploitable.
Use-after-free in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page execute arbitrary code within the renderer sandbox. The CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact, but per Google (Chromium severity: Medium) code execution is contained inside the sandbox, so host compromise requires chaining a separate sandbox-escape flaw; no authentication is needed but user interaction is mandatory. No public exploit code or confirmed active exploitation was identified at time of analysis, and users on auto-updating channels are remediated without manual action.
Use-after-free in Google Chrome's compositing component enables remote code execution inside the browser sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47. The CVSS vector indicates unauthenticated network access but requires user interaction (UI:R), and the description limits impact to code execution inside the sandbox rather than host escape without a separate sandbox-escape flaw. No public exploit code was identified at time of analysis; Google has released Chrome 156.0.8078.47 as the vendor fix, and risk is tempered by sandbox containment and the need to lure a user to attacker-controlled HTML.