Google Chrome: Use after free in DevTools allows sandbox escape
Summary
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in the DevTools component. A remote attacker who lures a user to a crafted HTML page may be able to execute arbitrary code outside the browser sandbox. NVD rates the flaw CVSS 9.6 (critical), while Google rates it Low in Chromium severity.
Affected
- Google Chrome prior to 156.0.8078.47 (desktop, Windows, macOS and Linux)
- Chromium-based browsers depend on their own vendor fixes (e.g. Microsoft Edge)
- Linux distributions: fixed package versions unknown
Fixed in
- Google Chrome 156.0.8078.47 or later (Windows and macOS 156.0.8078.48 per Wikipedia; Linux 156.0.8078.47)
- Microsoft Edge 156.0.4314.42 or later (per HKCERT)
- Debian DSA 6577-1 and DLA 4853-1 issued; fixed package versions unknown
- Ubuntu chromium-browser packages: not affected, Chromium snap channel must be checked
Workaround
- No workaround is needed if the update is applied.
- If patching is delayed, restricting DevTools via enterprise policy is general guidance for DevTools use-after-free bugs; the exact policy name and its effect on this CVE are unconfirmed.
Exploitation
- No evidence of exploitation in the wild found; third-party trackers list the CVE as not in CISA KEV (CISA KEV not checked directly).
- No public proof of concept found.
- EPSS about 0.47% (third-party snapshot).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Treat as a high-priority browser update: deploy Chrome 156.0.8078.47 or later to all endpoints within days.
- Restart browsers after the update and verify the installed version in your inventory.
- Check Chromium-based browsers and Linux packages separately with their vendors.
- Re-check CISA KEV and the Chromium bug for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 553259748 issues.chromium.org
- Microsoft Security Update Guide CVE-2026-113116 msrc.microsoft.com
- HKCERT Microsoft Edge security bulletin www.hkcert.org
- Ubuntu CVE-2026-113116 ubuntu.com
- Vulners CVE-2026-113116 vulners.com
- Chrome 156 Stable what's new (Chrome Geek) www.chromegeek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:35.
Original description (NVD)
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.