Google Chrome: Use-after-free in WebSockets allows code execution in sandbox
Summary
A use-after-free flaw in the WebSockets component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, for example through a malicious website or a link in a phishing email, and no login is required. NVD rates the issue CVSS 8.8 (High), while Chromium rates it Medium; no in-the-wild exploitation or public proof of concept was found.
Affected
- Google Chrome prior to 156.0.8078.47
- Chromium-based browsers may need their own fixes; Microsoft Edge ingests the Chromium fix
- The CVE record's version range is unclear ("156.0.8078.47 to < 156.0.8078.47")
Fixed in
- Google Chrome 156.0.8078.47 (Linux) and 156.0.8078.47 or 156.0.8078.48 (Windows, Mac), per third-party listings
- Newer Stable builds, such as 156.0.8078.79 (Windows, Mac, Linux), were reported by third parties; the release date could not be confirmed from Google's page
- Debian DSA 6577-1 and DLA 4853-1 (chromium updates); Ubuntu lists the chromium-browser package as not affected because it installs the Chromium snap
Workaround
Unknown.
No vendor-listed workaround. Updating the browser is the fix.
Exploitation
- Exploited in the wild: no evidence found.
- Public proof of concept: none found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.00471 is a model estimate, not evidence of exploitation.
- Not verified directly against the CISA KEV catalogue.
Our recommendation
- Check the Chrome version on all endpoints and confirm it is at least 156.0.8078.47, preferably the newest Stable build.
- Force a browser relaunch where an update is pending, because Chrome applies updates only after restart.
- On Linux, confirm that Debian or Ubuntu Chromium packages or the snap refresh are current.
- For managed devices, enforce the browser update with your existing management tools.
- Monitor the Chromium bug tracker and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Ubuntu security: CVE-2026-113037 ubuntu.com
- Vulners: CVE-2026-113037 (CVE list) vulners.com
- Vulners: MS:CVE-2026-113037 vulners.com
- TechSpot: Google Chrome download www.techspot.com
- BrowserHow: Chrome 156 stable update browserhow.com
- Wikipedia: Google Chrome en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:47.
Original description (NVD)
Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.