{"id":"CVE-2026-119269","kind":"vulnerability","aliases":["CVE-2026-119269"],"related":[],"title":"Chrome: use-after-free in Blink lets a crafted web page run code","description":"Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A use-after-free bug in Blink, the rendering engine inside Google Chrome, can be triggered by a crafted HTML page. A remote attacker who gets a victim to load that page can execute arbitrary code inside the browser sandbox.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","mobile","package"],"not_affected_if":["chrome-158-or-later"],"how_to_check":"- Check the installed Chrome version in the browser's About page or with `google-chrome --version` on Linux.\n- Compare it with the fixed version below; anything older is exposed.","fix":"- Google Chrome: move to `156.0.8078.79` or later.","status":"open","published_at":"2026-10-30T01:16:45+00:00","first_seen_at":"2026-10-30T01:27:58+00:00","triaged_at":"2026-10-30T01:29:51+00:00","updated_at":"2026-10-30T01:29:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T01:29:51Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `156.0.8078.79` or later.","reach":"internet","title":"Chrome: use-after-free in Blink lets a crafted web page run code","impact":"high","summary":"A use-after-free bug in Blink, the rendering engine inside Google Chrome, can be triggered by a crafted HTML page. A remote attacker who gets a victim to load that page can execute arbitrary code inside the browser sandbox.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","browser","desktop","mobile"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code inside the browser sandbox after a victim visits a page","analyst_note":"","how_to_check":"- Check the installed Chrome version in the browser's About page or with `google-chrome --version` on Linux.\n- Compare it with the fixed version below; anything older is exposed.","plain_action":"Update Google Chrome to version 156.0.8078.79 or later: Menu > Help > About Google Chrome.","needs_analyst":false,"not_affected_if":["chrome-158-or-later"],"who_is_affected":"Any device running Google Chrome older than 156.0.8078.79 is exposed when a user visits a malicious page. Chromium-based browsers that pick up the same Blink code may also be affected, but the sources do not say which ones. Users who never open untrusted web pages face less practical risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4101,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119269':17A,20A '-2026':16A,19A '156.0.8078.79':77C 'allow':78C 'arbitrari':61B,84C 'attack':50B,81C 'blink':7A,33B,71C 'browser':21B,65B 'bug':31B 'chrome':1A,22B,39B,74C 'chromium':94C 'code':14A,62B,85C 'craft':10A,45B,91C 'cve':15A,18A 'desktop':23B 'engin':36B 'execut':60B,83C 'free':5A,30B,69C 'get':52B 'googl':38B,73C 'high':97C 'html':46B,92C 'insid':37B,63B,86C 'let':8A 'load':56B 'mobil':24B 'packag':25B 'page':12A,47B,58B,93C 'prior':75C 'remot':49B,80C 'render':35B 'run':13A 'sandbox':66B,88C 'secur':95C 'sever':96C 'trigger':42B 'use':3A,28B,67C 'use-after-fre':2A,27B 'via':89C 'victim':54B 'web':11A","nicknames":[],"mitigations":[],"who_affected":"Any device running Google Chrome older than 156.0.8078.79 is exposed when a user visits a malicious page. Chromium-based browsers that pick up the same Blink code may also be affected, but the sources do not say which ones. Users who never open untrusted web pages face less practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 156.0.8078.79 or later: Menu > Help > About Google Chrome.","first_public_at":"2026-10-30T01:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119269","severity":null,"published_at":"2026-10-30T01:16:45+00:00","modified_at":"2026-10-30T01:16:45+00:00","first_seen_at":"2026-10-30T01:27:58+00:00","fetched_at":"2026-10-30T01:27:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}