Google Chrome: Use after free in Turbolev allows code execution in sandbox
Summary
Google Chrome on desktop and Android contains a use-after-free vulnerability in the Turbolev component, tracked as CVE-2026-113160 and rated High (CVSS 3.1: 8.8). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires no login, but the victim must open the page, so phishing links and malicious advertisements are the likely delivery routes. Whether a separate sandbox escape is needed for full system compromise is unknown.
Affected
- Google Chrome prior to 156.0.8078.47 (CVE record)
- Microsoft Edge prior to 156.0.4314.42 (HKCERT bulletin, not verified against the vendor)
- Chromium-based browsers that have not received the corresponding update
Fixed in
- Chrome 156.0.8078.47 or later (Linux and Android, according to secondary sources)
- Chrome 156.0.8078.47 or 156.0.8078.48 or later (Windows and macOS, according to secondary sources)
- Microsoft Edge 156.0.4314.42 or later (HKCERT)
- Unknown: whether a later Chrome build is required for this specific CVE; the vendor advisory could not be retrieved and should be checked
Workaround
- No workaround is documented. Update Chrome and restart the browser.
- Check the installed version after the update, because the rollout takes days or weeks.
Exploitation
- No evidence of in-the-wild exploitation was found.
- No public proof of concept was found.
- CISA KEV listing: not confirmed; check the catalog directly.
- EPSS score 0.00443 (low predicted exploitation probability).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check the Chrome version on all desktops and Android devices and update to the latest stable build.
- Check Microsoft Edge and other Chromium-based browsers against 156.0.4314.42 or later.
- Update Chromium on Linux systems through the distribution, including Snap-based installations.
- Confirm that browsers have been restarted after the update.
- Monitor the CISA KEV catalog for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Microsoft Security Update Guide: CVE-2026-113160 msrc.microsoft.com
- Ubuntu security tracker: CVE-2026-113160 ubuntu.com
- HKCERT security bulletin: Microsoft Edge www.hkcert.org
- Vulners CVE listing: CVE-2026-113160 vulners.com
- Cybersecurity News: Chrome security update cybersecuritynews.com
- Strix: CVE-2026-113160 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:30.
Original description (NVD)
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.