Google Chrome: Memory corruption in API allows code execution inside the sandbox
Summary
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in the API component (CWE-119). A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The official record does not claim a sandbox escape, and Chromium rates the issue Medium.
Affected
- Google Chrome prior to 156.0.8078.47 (Linux)
- Google Chrome prior to 156.0.8078.47/.48 (Windows and macOS, per secondary sources)
- Chromium-based browsers that include the affected Chromium code (for example Microsoft Edge): unverified
- Android Chrome: reported as affected, not verified with Google
Fixed in
- Google Chrome 156.0.8078.47 (Linux)
- Google Chrome 156.0.8078.47/.48 (Windows and macOS, per secondary sources)
- Android: not verified
- Fixed builds of other Chromium-based browsers: unknown
Workaround
- No workaround is known beyond updating.
- Restart the browser after the update, because the old process keeps running until then.
Exploitation
- In the wild: no evidence found (secondary sources only).
- CISA KEV: not checked directly.
- Public proof of concept: none found. The Chromium bug tracker entry was not accessible.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Update Google Chrome and all Chromium-based browsers to the fixed builds on all endpoints, including Edge and Linux snap installs.
- Verify the installed version on managed endpoints, not only the download status.
- Make sure users have restarted their browser after the update.
- Patch this together with the other Chrome 156 fixes. This is a routine update, not an emergency, because no exploitation is known.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium bug tracker issue 495471295 issues.chromium.org
- Vulners NVD record CVE-2026-113109 vulners.com
- HKCERT security bulletin on Google Chrome www.hkcert.org
- Ubuntu security tracker CVE-2026-113109 ubuntu.com
- Cybersecurity News: Chrome security update fixing 353 flaws cybersecuritynews.com
- GBHackers: Google Chrome 156 fixes 353 security vulnerabilities gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:02.
Original description (NVD)
Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.