Google Chrome: Use after free in Compositing allows sandboxed code execution
Summary
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in the Compositing component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires no privileges, but a user must open the page, and code execution is limited to the sandbox unless it is combined with a further sandbox escape.
Affected
- Google Chrome prior to 156.0.8078.47 (Windows, macOS, Linux)
- Chromium-based browsers that consume the affected Chromium code, such as Microsoft Edge (fixed build unknown)
Fixed in
- Google Chrome 156.0.8078.47 or later (minimum; build numbers differ by platform)
- Deploy the latest 156.x build, as later Compositing fixes exist
- Microsoft Edge: fixed build unknown, check Microsoft's Edge release notes
Workaround
- Unknown. No vendor-documented workaround was found; applying the update is the mitigation.
Exploitation
- No reports of in-the-wild exploitation, no CISA KEV listing and no public proof-of-concept were found at the time of research.
- An aggregator lists an EPSS of 0.00417, which is not confirmed from FIRST.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory Chrome and Edge versions on all endpoints and update to the latest 156.x build.
- Check Linux Chromium packages against the distribution's security advisories, as package versions differ.
- Verify that update policies do not pin or block browser updates.
- Re-check the Chromium bug and CISA KEV for exploitation reports.
- Handle this within the normal browser update cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 563163857 issues.chromium.org
- Microsoft MSRC: CVE-2026-113111 msrc.microsoft.com
- Ubuntu CVE tracker: CVE-2026-113111 ubuntu.com
- NVD record via Vulners: CVE-2026-113111 vulners.com
- Chrome Releases for Linux release log (TechSpot mirror) www.techspot.com
- Google Chrome release mirror (TechSpot) www.techspot.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:53.
Original description (NVD)
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.