Google Chrome: Use-after-free in Turbolev allows code execution in sandbox
Summary
Google Chrome contains a use-after-free vulnerability (CWE-416) in the component Turbolev. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVSS score is 8.8 (high). The attack requires that the victim visits the malicious page, for example via a link in an email or a website.
Affected
- Google Chrome desktop builds prior to 156.0.8078.47 (per the CVE description)
- Android Chrome builds prior to 156.0.8078.47 (per secondary sources)
- iOS: Unknown. Sources conflict (156.0.8078.46 or 156.0.8078.54).
- Microsoft Edge: listed as fixed in 156.0.4314.42 or later (per HKCERT, secondary source)
- Note: CVE-2026-118350 describes the same Turbolev issue with the fixed version 156.0.8078.73. Its relationship to this CVE is unclear.
Fixed in
- Desktop: 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows, macOS), per secondary sources. Verify against the Chrome Releases post.
- Android: 156.0.8078.47 or later (per secondary sources)
- To cover CVE-2026-118350 as well: 156.0.8078.73 or later (per secondary sources)
Workaround
No workaround documented. Install the update.
Exploitation
- No evidence of exploitation in the wild found. The CVE is not listed in CISA KEV (per secondary source). EPSS: Unknown.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
Our recommendation
- Update Chrome on all desktop and mobile devices to the current stable version, at least 156.0.8078.73 as a precaution.
- Restart the browser after the update, because running browser processes may still be the old version.
- Check the browser version on all endpoints, including those where automatic updates are blocked.
- Check whether Chromium-based browsers such as Microsoft Edge are updated as well.
- Monitor the CISA KEV catalogue for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 570003644 issues.chromium.org
- Vulners: CVE-2026-113019 vulners.com
- Ubuntu security: CVE-2026-113019 ubuntu.com
- HKCERT security bulletin: Microsoft Edge multiple vulnerabilities www.hkcert.org
- Penligent: Chrome 156 security update www.penligent.ai
- TechGeeks: Security notice Google Chrome 156 stable www.techgeeks.org
- GitHub astruzocyber/CVE issue 3413 (CVE-2026-118350) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:57.
Original description (NVD)
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.