Google Chrome: Use after free in V8 JavaScript engine

Summary

Google Chrome desktop versions before 156.0.8078.47 contain a Use-after-Free flaw in the V8 JavaScript engine, rated High severity with a CVSS score of 9.6. A remote attacker can host a crafted HTML page and may execute arbitrary code outside the browser sandbox. No user interaction beyond visiting the page is described in the record, although the CVSS vector requires user interaction (UI:R), so the victim must open the page.

Affected

• Google Chrome desktop versions prior to 156.0.8078.47 (per NVD description)
• Chromium-based products that consume the affected Chromium code, such as Microsoft Edge: affected range and fixed build unknown, check the vendor advisory
• Note: the CVE record's affected field and the third-party VulDB range (up to 155.0.8059.84) differ from the NVD description; the NVD description is used here.

Fixed in

• Chrome 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows and Mac), per Google's Stable Channel Update for Desktop (CVE line not visible in the excerpt, confirm on the page)
• Debian: DSA 6577-1 (22 Oct 2026) and DLA 4853-1 (23 Oct 2026)
• Ubuntu: refresh the Chromium snap, the chromium-browser package is marked not affected
• Mobile platforms (Android, iOS): unverified, check Google's advisory

Workaround

Unknown. No workaround was found. Updating to a fixed version is the mitigation.

Exploitation

• No evidence found of in-the-wild exploitation or a public proof of concept.
• CISA SSVC assessment in the CVE record: exploitation none, not automatable, total technical impact.
• A third-party tracker lists the CVE as not in the CISA KEV catalog; cisa.gov was not checked directly.
• A broker-style price estimate of USD 5,000 to 25,000 exists (VulDB); this is not evidence of exploitation.

Our recommendation

• Update Google Chrome to version 156.0.8078.47 or later on all desktop devices and restart the browser, because an open old process keeps the vulnerable code running.
• Use managed Chrome update policies or MDM to force the update and track devices that still run older versions.
• Update Chromium-based browsers such as Microsoft Edge and Linux Chromium packages (including snaps) according to their vendors.
• Check the vendor advisory for mobile platforms and confirm coverage.
• Monitor for exploitation news, since other V8 flaws were exploited in 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker issues.chromium.org
• Vulners CVE record mirror vulners.com
• Microsoft MSRC update guide msrc.microsoft.com
• Ubuntu security tracker ubuntu.com
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:28.