Google Chrome: Memory corruption in Extensions allows sandbox code execution
Summary
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in the Extensions component (CWE-119). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page, without authentication. Impact is described as limited to the sandbox, so a sandbox escape would be needed for full system compromise. Google rates the issue Medium, while the NVD CVSS score is 8.8.
Affected
- Google Chrome desktop builds prior to 156.0.8078.47 (per CVE record)
- Chromium-based browsers that include the affected code, such as Microsoft Edge, may also be affected
- Android is listed in secondary sources at 156.0.8078.47; affected status for Android is unverified
Fixed in
- Chrome 156.0.8078.47 (threshold stated in CVE record)
- Secondary sources list 156.0.8078.48 for Windows and macOS and 156.0.8078.47 for Linux; not yet verified against the vendor advisory
Workaround
Unknown. No workaround is documented; updating and restarting the browser is the practical mitigation.
Exploitation
- No in-the-wild exploitation is reported in the sources reviewed.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- CISA KEV status was not verified directly.
- No public proof of concept found.
Our recommendation
- Update all Chrome and Chromium-based browsers to at least 156.0.8078.48 on Windows and macOS and 156.0.8078.47 on Linux and Android, after confirming the versions against the vendor advisory.
- Restart browsers after updating, since the old process may keep running.
- Verify the running version on managed endpoints instead of assuming the update applied.
- Monitor CISA KEV and the vendor advisory for changes in exploitation status.
- Note that the Chromium tracker linked from the CVE describes a logic flaw; the CVE-to-issue mapping should be confirmed with Google.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 517461056 issues.chromium.org
- NVD record via Vulners CVE-2026-113185 vulners.com
- Microsoft Security Update Guide CVE-2026-113185 msrc.microsoft.com
- HKCERT security bulletin on Google Chrome www.hkcert.org
- Cybersecurity News: Chrome security update fixing 353 flaws cybersecuritynews.com
- Wikipedia: Google Chrome en.wikipedia.org
- Windows Forum: Chrome 156 security update windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:12.
Original description (NVD)
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.