Google Chrome: Use-after-free in Script component
Summary
Google Chrome before 156.0.8078.47 contains a use-after-free flaw in the Script component (CWE-416). A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits the malicious page; no privileges are needed.
Affected
- Google Chrome (desktop) versions before 156.0.8078.47, per the CVE record
- Chromium-based products that consume the affected code (for example Microsoft Edge) may be affected; their fixed versions differ
Fixed in
- Google Chrome 156.0.8078.47 or later; deploy the newest stable build
- Microsoft Edge: check MSRC for the official fixed version
Workaround
- Unknown. No vendor workaround found. Apply the Chrome update.
Exploitation
- No evidence of in-the-wild exploitation or public proof of concept found as of late October 2026.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.00417 (low predicted exploitation probability).
Our recommendation
- Verify that Chrome is at 156.0.8078.47 or later (preferably the newest stable build) on all endpoints.
- Check Microsoft Edge and Linux Chromium packages or snaps against their vendor advisories.
- Enforce automatic browser updates on managed devices and monitor for devices that lag behind.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Microsoft Security Update Guide: CVE-2026-113108 msrc.microsoft.com
- Vulners CVE record CVE-2026-113108 vulners.com
- Ubuntu security CVE-2026-113108 ubuntu.com
- Strix CVE-2026-113108 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:02.
Original description (NVD)
Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.