Description
Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-11-03
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free vulnerability in Chrome’s Paint component permits a remote attacker to execute arbitrary code inside the browser’s sandbox when a specially crafted HTML page is loaded. The flaw arises from an object being freed prematurely and subsequently referenced, causing the browser to run unexpected code. The weakness is classified as CWE‑416.

Affected Systems

Google Chrome browsers running a version before 157.0.8103.38 are affected by this flaw. No other vendors, products, or versions are listed as impacted.

Risk and Exploitability

The flaw can be triggered remotely by a malicious HTML page that a vulnerable user visits or loads. The attacker can run arbitrary code within the Chrome sandbox. No additional privileges or mitigations beyond the sandbox are bypassed by the vulnerability.

Generated by OpenCVE AI on November 3, 2026 at 23:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 157.0.8103.38 or later.
  • Ensure Chrome’s sandbox is enabled and never disabled for ordinary browsing.
  • Enable site isolation and configure a strict Content Security Policy to reduce the attack surface before the vulnerability is patched.
  • Avoid opening or browsing untrusted or suspicious HTML files until a patch is applied.

Generated by OpenCVE AI on November 3, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:30:00 +0000

Type Values Removed Values Added
Title Use‑after‑Free in Chrome Paint Enables Remote Code Execution

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:42:17.984Z

Reserved: 2026-11-03T09:40:43.545Z

Link: CVE-2026-121117

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:19.490

Modified: 2026-11-03T22:19:38.133

Link: CVE-2026-121117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T23:15:04Z

Weaknesses