Google Chrome: Memory corruption in Transactions Platform

Summary

Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw (CWE-119) in the Transactions Platform component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires that the victim opens the page, and the sandbox boundary limits the impact unless it is combined with a further sandbox escape.

Affected

• Google Chrome desktop and Android builds prior to 156.0.8078.47
• Source conflict: the CVE record lists the affected range as "156.0.8078.47 to < 156.0.8078.47", which is contradictory; the CVE description states prior to 156.0.8078.47
• Ubuntu lists its chromium-browser packages as not affected (Ubuntu ships Chromium as a snap)
• Debian chromium packages have updates (DSA 6577-1, DLA 4853-1); package versions unverified

Fixed in

• Google Chrome 156.0.8078.47 or later for Linux and Android (per secondary reporting)
• Google Chrome 156.0.8078.47 or later for Windows and macOS (Wikipedia lists 156.0.8078.48; unverified against the vendor post)
• Check the Chrome Releases post and Debian advisories for exact versions

Workaround

• No workaround is documented in the sources.
• Apply the browser update and restart the browser, as a staged update may not take effect until relaunch.
• Mitigation by configuration: Unknown.

Exploitation

• Exploited in the wild: no evidence found.
• Not listed in CISA KEV; EPSS: Unknown.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Public proof of concept: none found.
• VulDB estimates an exploit price range of USD 5k-25k; this is a market estimate, not evidence of an available exploit.

Our recommendation

• Update all desktop and Android Chrome installations to 156.0.8078.47 or later (156.0.8078.47 or .48 on Windows and macOS) and restart the browser.
• Verify the exact version numbers against the Chrome Releases advisory.
• Check Chromium-based browsers and Linux packages separately, as they follow their own release schedules.
• Monitor for exploitation news; the risk is high for SMEs that do not patch promptly, since staff browse the web by default.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker entry issues.chromium.org
• VulDB entry CVE-2026-113008 vuldb.com
• Ubuntu security CVE-2026-113008 ubuntu.com
• Strix CVE-2026-113008 www.strix.ai
• Vulners MS:CVE-2026-113008 (Debian DSA/DLA listing) vulners.com
• Cybersecurity News: Chrome security update fixing 353 flaws cybersecuritynews.com
• Wikipedia: Google Chrome en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:01.