Google Chrome: Use-after-free in ServiceWorker allows code execution
Summary
Google Chrome prior to 156.0.8078.47 contains a use-after-free vulnerability (CWE-416) in the ServiceWorker component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. A user must visit the malicious page, and the impact is limited to the sandbox, so a further exploit is needed to escape it.
Affected
- Google Chrome prior to 156.0.8078.47
- Chromium-based Microsoft Edge prior to 156.0.4314.42 (per secondary sources)
- Linux distributions shipping chromium (for example Debian, per vendor-tracker references)
Fixed in
- Google Chrome 156.0.8078.47 or later (secondary sources report 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and macOS)
- Install the newest stable Chrome 156 build, then the current stable channel
- Microsoft Edge 156.0.4314.42 or later
- Debian: DSA 6577-1 and DLA 4853-1 for chromium
- Ubuntu: chromium-browser is a wrapper; check that the Chromium snap has refreshed
Workaround
No workaround is documented. Applying the update is the mitigation.
Exploitation
- No evidence of exploitation found
- Not listed in CISA KEV
- No public proof of concept found
- Unknown whether private exploitation exists
Our recommendation
- Update Chrome and Edge on all staff machines to the fixed versions and verify versions across the fleet
- Prioritise machines still below 156.0.8078.47 that have browsing access
- Restart browsers so pending updates take effect
- Check that managed update policies are not delaying the release
- Check that Linux systems with the Chromium snap have refreshed
- Monitor for updates to this CVE and for exploitation reports
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Vulners CVE record (CVELIST) vulners.com
- Strix CVE summary www.strix.ai
- HKCERT security bulletin (Microsoft Edge) www.hkcert.org
- Ubuntu security tracker ubuntu.com
- VulDB entry vuldb.com
- Chrome 156 stable what's new (ChromeGeek) www.chromegeek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:14.
Original description (NVD)
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.