Google Chrome: Use after free in Compositing allows code execution in sandbox
Summary
A use-after-free vulnerability in the Compositing component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to visit a crafted HTML page, so no account is required but user interaction is necessary. Full system compromise would additionally require a separate sandbox escape.
Affected
- Google Chrome prior to 156.0.8078.47 (Windows, macOS, Linux)
- Microsoft Edge (Chromium-based) is affected through the upstream Chromium code; the fixed Edge build was not found.
- Ubuntu chromium-browser package is marked not affected because it installs the Chromium snap.
Fixed in
- Google Chrome 156.0.8078.47 or later; the latest 156.x build is recommended.
- Debian (DSA 6577-1, DLA 4853-1) and FreeBSD issued updates; check these for exact fixed Chromium builds.
Workaround
- None required when the update is applied. Keep automatic updates enabled.
Exploitation
- No known exploitation at the time of research. No CISA KEV entry, vendor statement of in-the-wild use or public proof of concept was found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Confirm all Chrome and Edge endpoints run 156.0.8078.47 or later, preferably the latest 156.x build.
- Verify that users have restarted Chrome after the update was downloaded, since the update takes effect only on relaunch.
- Check managed fleets for pinned older browser versions and monitor the CISA KEV catalogue for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Microsoft Security Update Guide msrc.microsoft.com
- Ubuntu Security: CVE-2026-113081 ubuntu.com
- Vulners: CVE-2026-113081 vulners.com
- TechSpot: Google Chrome downloads www.techspot.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:18.
Original description (NVD)
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.