New vulnerabilities – clearly explained

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Memory corruption in V8 JavaScript engine allows code execution

The Google Chrome desktop browser contains a memory corruption flaw in the V8 JavaScript engine (CVE-2026-113192, CVSS 8.8). A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. No authentication is required, but the user must open the malicious or compromised page. The vendor does not claim a sandbox escape; a full compromise would normally need a second vulnerability.

Google · Chrome

Google Chrome: Use after free in Internals component on macOS

A use-after-free flaw in the Internals component of Google Chrome on macOS allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker must lure a user to a crafted HTML page, for example via phishing or a malicious website. Google rates the issue Medium in Chromium, and the CVSS base score is 8.8; no in-the-wild exploitation or public proof of concept was found.

Google · Chrome

Google Chrome: Use-after-free in ServiceWorker allows code execution

Google Chrome prior to 156.0.8078.47 contains a use-after-free vulnerability (CWE-416) in the ServiceWorker component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. A user must visit the malicious page, and the impact is limited to the sandbox, so a further exploit is needed to escape it.

Google · Chrome

Google Chrome: Use after free in Core allows code execution outside sandbox

A use-after-free flaw in the Core component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code outside the browser sandbox. The attack needs only a crafted HTML page, so a phishing link or a compromised website is enough, and the user must open the page. NVD rates the issue Critical (CVSS 9.6), while Google rates it Medium. Chromium-based browsers such as Microsoft Edge are affected as well.

Google · Chrome

Google Chrome: Memory corruption in GPU component

Google Chrome contains a memory corruption flaw in its GPU component (CWE-119). A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No privileges are required, but user interaction is needed, and the NVD rates the issue CVSS 8.8 (High). Public exploitation has not been confirmed.

Google · Chrome

Google Chrome: Use-after-free in DOM allows code execution in sandbox

A use-after-free flaw in the DOM component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to visit a crafted HTML page, so user interaction is required and no login is needed. Chromium rates the flaw Medium and CVSS 3.1 is 8.8; code execution inside the sandbox alone does not normally give full system control.

Google · Chrome

Google Chrome: Memory corruption in DevTools allows code execution

Memory corruption in the DevTools component of Google Chrome allows a remote attacker to execute arbitrary code outside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, so no login is required. NVD rates the issue 9.6 (Critical), while VulDB rates it 6.3 (Medium); the official score should be confirmed on NVD.

Google · Chrome

Google Chrome: Memory corruption in Extensions allows sandbox code execution

Google Chrome before 156.0.8078.47 contains a memory corruption flaw in the Extensions component (CWE-119). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page, without authentication. Impact is described as limited to the sandbox, so a sandbox escape would be needed for full system compromise. Google rates the issue Medium, while the NVD CVSS score is 8.8.

Google · Chrome

Google Chrome: Memory corruption in Scheduling allows sandbox code execution

Google Chrome prior to 156.0.8078.47 contains a memory corruption flaw in its Scheduling component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires the user to open the malicious page, for example through a link or a compromised website.

Google · Chrome

Google Chrome: Memory corruption in FedCM allows sandboxed code execution

Google Chrome prior to 156.0.8078.47 contains a memory corruption flaw in the FedCM (Federated Credential Management) web API. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, and the sources do not describe a sandbox escape.

Google · Chrome

Google Chrome Passwords: Memory corruption allows code execution in sandbox

Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption flaw in the Passwords component (CWE-119). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The description does not state a sandbox escape, so full system compromise is not described by this CVE.

Google · Chrome

Google Chrome: Use after free in Navigation allows sandboxed code execution

Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in the Navigation component (CWE-416), rated High by Chromium. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires that the user visits the page, and full system compromise would normally need a second sandbox-escape flaw.

Google · Chrome

Google Chrome: Memory corruption in ContentCapture allows sandboxed code execution

Memory corruption in the ContentCapture component of Google Chrome on Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, for example via a phishing link or a malicious website. The CVSS score is 8.8 (High), while Chromium rates the issue Low; a sandbox escape would be required for full device compromise.

Google · Chrome

Google Chrome: Use-after-free in Paint allows code execution in sandbox

A use-after-free vulnerability (CWE-416) in the Paint component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the user to load a crafted HTML page, for example via a link or a malicious website, and no authentication is required. Full compromise of the device would normally also require a sandbox escape, for which no evidence was found.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Use-after-free in FileSystem allows sandbox code execution

A use-after-free vulnerability (CWE-416) in the FileSystem component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page. Full compromise would normally require a second vulnerability to escape the sandbox.

Google · Chrome

Google Chrome: Memory corruption in Omnibox

Memory corruption in the Omnibox (address bar and search box) of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attack requires that a victim opens a crafted HTML page. Full compromise of the system would normally require an additional sandbox escape.

Google · Chrome

Google Chrome: Improper input validation in FileSystem enables sandbox code execution

Improper input validation in the FileSystem component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker must lure a user to a crafted HTML page, so user interaction is required. The vendor describes the impact as code execution inside the sandbox, not as a confirmed sandbox escape. The CNA rates the issue High (CVSS 3.1: 8.8), while VulDB scores it 6.3 (Medium).

Google · Chrome

Google Chrome: Use after free in Extensions

A use-after-free flaw in the Extensions component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the sandbox. The attacker needs a victim to open a crafted HTML page, so user interaction is required. Because the code runs inside the sandbox, a full compromise may require an additional sandbox escape, which is an inference and not a vendor statement.

Google · Chrome

Google Chrome for Android: Improper input validation in UI

Improper input validation in the user interface of Google Chrome for Android before 156.0.8078.47 can be abused by a remote attacker. A crafted HTML page that a user opens could potentially lead to arbitrary code execution inside the browser sandbox. No login is required, but user interaction is needed. Google rates the issue Low, while the CNA scores it 8.8 (CVSS 3.1), so the impact should be checked against the vendor advisory.

Google · Chrome for Android

Google Chrome: Memory corruption in ServiceWorker

A memory corruption flaw in the ServiceWorker component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attack requires a user to open a crafted HTML page. Chromium rates the issue Medium and NVD scores it 8.8 (High). A sandbox escape would be needed for full system compromise, and the sources report no known exploitation.

Google · Chrome

Google Chrome: Memory corruption in Prompts allows sandbox escape on Android

A memory corruption flaw in the Prompts component of Google Chrome for Android before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code outside the Chrome sandbox. The attacker needs a crafted HTML page that the user must open, so user interaction is required. Google rates the Chromium security severity as Medium, while the CVSS score is 9.6 (critical) because the scope is changed. The sources disagree on the bug type, and no exploitation has been observed.

Google · Chrome

Google Chrome: Use-after-free in Autofill on Android

A use-after-free flaw in the Autofill component of Google Chrome for Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the user to open a crafted HTML page, but no login. NVD rates the issue 8.8 (High), while Google's Chromium severity is Medium.

Google · Chrome

Google Chrome: Memory corruption in WebAppInstalls on Android

Google Chrome for Android contains a memory corruption flaw in the WebAppInstalls component (CWE-119). An attacker who lures a user to a crafted HTML page can execute arbitrary code outside the browser sandbox. The attack requires the user to open the page, but no privileges. NVD rates it 9.6 (critical), while Chromium rates it Low.

Google · Chrome