Google Chrome: Memory corruption in PerformanceAPIs allows code execution
Summary
Google Chrome desktop builds before 156.0.8078.47 contain a memory corruption flaw in the PerformanceAPIs component (CWE-119). A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack only requires that a user visits the malicious page, and no login is needed. Google rates the Chromium severity as Low, while NVD scores the CVE 9.6 (Critical).
Affected
- Google Chrome desktop before 156.0.8078.47 (Windows, macOS, Linux)
- Android Chrome: reported as affected, not verified
- Chromium-based Edge: depends on the bundled Chromium version, not verified
- Ubuntu tracker lists chromium-browser as not affected; Ubuntu ships Chromium as a snap, so check the snap version
- The official CVE record affected range is inconsistent ("156.0.8078.47 to < 156.0.8078.47")
Fixed in
- Linux: 156.0.8078.47 or later
- Windows and macOS: 156.0.8078.48 or later (from secondary sources; confirm with Google's advisory)
- Debian and FreeBSD chromium packages have updates; fixed package versions unknown
Workaround
- No workaround is needed; updating is the fix.
- Restart the browser after updating, because old browser processes may keep running.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation or a public proof of concept was found at the time of research.
Our recommendation
- Update Google Chrome and other Chromium-based browsers to the fixed version now.
- Restart browsers after the update and verify the installed version.
- Inventory browser versions across the fleet and keep evidence of the deployment.
- Check Linux and snap package versions separately.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- VulDB CVE-2026-113056 vuldb.com
- Ubuntu security tracker CVE-2026-113056 ubuntu.com
- Vulners CVE list entry (Debian, FreeBSD) vulners.com
- Cybersecurity News: Chrome security update cybersecuritynews.com
- TechGeeks: Security notice Google Chrome 156 www.techgeeks.org
- Google Chrome (Wikipedia) en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:38.
Original description (NVD)
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.