Google Chrome: Use-after-free in WebAppInstalls

Summary

A use-after-free flaw in the WebAppInstalls component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, and no login is required. Google rates the Chromium security severity as Low, while the CVSS base score is 8.8. No exploitation in the wild is known.

Affected

• Google Chrome desktop versions prior to 156.0.8078.47 (CVE description)
• The CVE record's affected range text is contradictory (156.0.8078.47 to < 156.0.8078.47) and should be read as all versions before 156.0.8078.47
• Chromium-based products that ingest the fix, such as Microsoft Edge, are affected until they are updated

Fixed in

• Chrome 156.0.8078.47 or later (Linux, per secondary sources)
• Chrome 156.0.8078.48 or later reported for Windows and macOS by some secondary sources; another source lists 156.0.8078.47 for these platforms too
• Vendor advisory not verified directly: check the Chrome Releases post for the exact build
• Linux distributions: check their Chromium package or snap, as the fix is delivered there separately

Workaround

Unknown. No vendor-documented workaround is available. Updating is the required remedy.

Exploitation

• No evidence of exploitation in the wild found in the sources
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total
• Strix lists the CVE as not in KEV
• No public proof of concept found

Our recommendation

• Confirm that all managed Chrome and Chromium-based browsers (including Edge) run version 156.0.8078.47 or later, or the build specified for your platform
• Restart the browser after the update so the new version is active
• Track the staged rollout in your endpoint management and check for laggard devices
• Monitor for signs of exploitation and keep browsers on the stable channel

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker entry issues.chromium.org
• Strix CVE-2026-113080 www.strix.ai
• Microsoft Security Update Guide msrc.microsoft.com
• Ubuntu CVE-2026-113080 ubuntu.com
• Cybersecurity News: Chrome security update fixing 353 flaws cybersecuritynews.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:18.