Google Chrome: Memory corruption in DevTools allows sandbox code execution
Summary
A memory corruption flaw (CWE-119) in the DevTools component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page, so user interaction is required, and the description limits the impact to the sandbox. NVD rates the issue 8.8 (High), while Chromium rates it Low.
Affected
- Google Chrome prior to 156.0.8078.47 (per the CVE description)
- Secondary sources list .47 or .48 builds for Windows and macOS; verify against the vendor advisory
- Microsoft Edge is listed in a Hong Kong CERT bulletin with a fixed version of 156.0.4314.42; not confirmed by Microsoft
Fixed in
- Google Chrome 156.0.8078.47 (Linux); 156.0.8078.47 or .48 (Windows, macOS), per secondary sources
- Vendor advisory: Chrome Releases, Stable Channel Update for Desktop, 20 October 2026
Workaround
- Unknown. No vendor workaround is documented in the sources; apply the update.
- Unverified: restricting DevTools via the Chrome Enterprise policy DeveloperToolsAvailability may reduce exposure on managed devices. Confirm the policy behaviour in Google's documentation first.
Exploitation
- No known exploitation in the wild (CISA KEV: not listed, per a secondary tracker).
- CISA SSVC: exploitation none, not automatable, total technical impact.
- VulDB reports no public technical details or exploit.
Our recommendation
- Inventory Chrome versions on all desktops, including Windows and macOS devices with .47 or .48 builds.
- Update Chrome to 156.0.8078.47 or later (Linux) or the matching Windows and macOS build, and fully restart the browser.
- Check Microsoft Edge and other Chromium-based browsers or Linux distribution packages against their own vendor advisories.
- Prioritise this patch; it is not an emergency, as no exploitation is known and exploitation requires user interaction.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- NVD record via Vulners vulners.com
- VulDB entry 424121 vuldb.com
- Ubuntu CVE tracker ubuntu.com
- Hong Kong CERT bulletin on Microsoft Edge www.hkcert.org
- Chrome 156 security update overview (Cybersecurity News) cybersecuritynews.com
- Chrome 156 security update overview (GBHackers) gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:03.
Original description (NVD)
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.