Google Chrome: Improper input validation in Extensions
Summary
Google Chrome versions before 156.0.8078.47 contain an input validation flaw in the Extensions component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, and NVD and Microsoft rate it as CVSS 8.8 (High).
Affected
- Google Chrome prior to 156.0.8078.47 (desktop)
- Chromium-based builds that include the fix are affected until they are updated; Microsoft Edge is listed as affected by the same Chromium issue
- Android Chrome applicability: unconfirmed
Fixed in
- Google Chrome 156.0.8078.47 or later (Linux)
- Windows and Mac: build 156.0.8078.48 is reported as the fixed build where offered; some sources list only .47, so verify against the vendor post
- Debian and Ubuntu: fixed versions unverified; check the distribution advisories and the Chromium snap version
Workaround
Unknown. No workaround has been published; updating is the remedy.
Exploitation
- No evidence of known exploitation found at the time of writing
- Not listed in the CISA KEV catalog according to a secondary source
- The public Chromium bug report, now marked Fixed, contains a proof-of-concept section that has not been reviewed; treat as an n-day risk after patching
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Check the Chrome version on all endpoints, including the Windows and Mac build numbers
- Confirm that automatic updates work and restart browsers so that the patched version is actually running
- Enforce updates via Chrome Enterprise policy or endpoint management
- Review installed extensions and remove unused ones (general hardening)
- Check Ubuntu and Debian systems for the patched Chromium package or snap version
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Google Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- NVD mirror entry (Vulners) vulners.com
- Microsoft Security Update Guide msrc.microsoft.com
- Ubuntu CVE tracker ubuntu.com
- Chrome 156 security update overview (Cybersecurity News) cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:55.
Original description (NVD)
Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.