Google Chrome: Use-after-free in Workers allows code execution in sandbox

Summary

A use-after-free vulnerability (CWE-416) in the Workers component of Google Chrome before 156.0.8078.47 can be exploited remotely. An attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page, with no authentication required. The sources describe code execution inside the sandbox only; full compromise would probably need a second sandbox-escape flaw, which is an inference and not confirmed.

Affected

• Google Chrome prior to 156.0.8078.47 (NVD description)
• Official CVE record lists an inconsistent range (156.0.8078.47 to < 156.0.8078.47); the NVD description is used here.
• Chromium-based browsers that consume the Chromium fix, including Microsoft Edge, per Microsoft

Fixed in

• Google Chrome 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows and Mac), per HKCERT
• Later release on 27 October 2026 (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux), per a secondary source; not verified against the vendor post
• Debian issued DSA 6577-1 and DLA 4853-1 for Chromium; Ubuntu's chromium-browser package is not affected because it installs the Chromium snap, which is the update path

Workaround

Unknown. No vendor workaround documented. The fix is the browser update; Chrome applies it only after a restart.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• No in-the-wild exploitation found in searches
• Not listed in CISA KEV according to a secondary GitHub issue; not checked directly
• No public proof of concept found in a limited search
• Chromium rates it Low severity; CVSS base score is 8.8

Our recommendation

• Update Google Chrome to the latest stable build, not only 156.0.8078.47, and restart the browser.
• Update Microsoft Edge and other Chromium-based applications.
• Enforce automatic updates through a managed policy.
• Check the browser version on all endpoints, including shared or kiosk systems, and prioritise workstations.
• Restrict browsing of untrusted sites where possible and monitor for phishing links.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker issues.chromium.org
• Microsoft Security Update Guide: CVE-2026-113015 msrc.microsoft.com
• HKCERT security bulletin: Google Chrome multiple vulnerabilities www.hkcert.org
• NVD mirror on Vulners: CVE-2026-113015 vulners.com
• Ubuntu security tracker: CVE-2026-113015 ubuntu.com
• Chrome security update guide, October 2026 (secondary) sandbanksdigital.com
• GitHub vulnerability alert issue: CVE-2026-113015 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:54.