Google Chrome: Use after free in Media component allows sandboxed code execution
Summary
A use-after-free flaw in the Media component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, so the risk is a drive-by attack through any web page. According to the CVE record, the impact is limited to the sandbox; a full system compromise would additionally require a sandbox escape, which is not described.
Affected
- Google Chrome on Windows prior to 156.0.8078.47
- The CVE record's affected field reads "156.0.8078.47 to < 156.0.8078.47", which is inconsistent; the "prior to 156.0.8078.47" wording of the description is used here.
- Other platforms: Unknown in the CVE text; Ubuntu lists its chromium-browser packages as not affected.
Fixed in
- Google Chrome 156.0.8078.47 (Stable channel, Windows)
- A later Stable build is reported by a secondary source; verify against Google's release notes.
Workaround
- Unknown. No vendor workaround is documented; the browser update is the fix.
Exploitation
- No evidence of exploitation in the wild or of public proof-of-concept code was found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Chromium severity is Low; third-party scores differ (CNA CVSS 8.8, VulDB 6.3).
Our recommendation
- Check the Chrome version on all Windows endpoints and update to at least 156.0.8078.47, preferably the current Stable build.
- Verify that automatic updates work and that browsers are restarted after updating.
- Check Microsoft Edge and other Chromium-based browsers for their own patch levels.
- Patch the browser as a whole, since Chrome 156 contains further security fixes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- NVD mirror (Vulners) vulners.com
- CVE text mirror (Vulners) vulners.com
- Microsoft MSRC msrc.microsoft.com
- VulDB vuldb.com
- Ubuntu security notice ubuntu.com
- Tenable plugin www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:27.
Original description (NVD)
Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.