Google Chrome: Memory corruption in Omnibox allows code execution in sandbox

Summary

Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in the Omnibox (address bar). A remote attacker can execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. No login is required, but the victim must open the page, for example through a phishing link or malicious advertisement. The description limits the impact to code execution inside the sandbox, so a full system compromise would require a separate sandbox escape.

Affected

• Google Chrome prior to 156.0.8078.47 (NVD)
• Google Chrome up to 155.0.8059.84 (VulDB range)
• Chromium-based browsers that include the Chromium OSS component, including Microsoft Edge (HKCERT advisory covers Edge builds before 156.0.4314.42)
• Linux distributions: the Ubuntu chromium-browser deb is listed as not affected; the Chromium snap is the relevant package

Fixed in

• Google Chrome 156.0.8078.47 or later (Linux)
• Google Chrome 156.0.8078.48 or later (Windows and Mac, recommended; newer 156 builds are available)
• Microsoft Edge 156.0.4314.42 or later (per HKCERT)
• Debian: DSA 6577-1 (reported, not verified directly)

Workaround

• None known. The vendor update is the remedy.
• Chrome applies updates on relaunch; users must restart the browser after the update.

Exploitation

• No in-the-wild exploitation reported.
• Not listed in the CISA KEV catalog at the time of research.
• No public proof-of-concept found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Chromium rates the issue Medium; NVD scores it CVSS 8.8, VulDB 6.3.

Our recommendation

• Update all Chrome and Edge installations to the fixed versions within days.
• Verify the installed build on endpoints, for example via MDM or Chrome Enterprise reporting.
• Enforce automatic updates and browser restarts through your management tools.
• Check Ubuntu systems for the Chromium snap version rather than the deb package.
• Keep users aware of phishing links and malicious ads, as these are the likely attack path.
• Monitor CISA KEV and Chrome release notes for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker entry issues.chromium.org
• Microsoft Security Update Guide: CVE-2026-113206 msrc.microsoft.com
• NVD record mirror: CVE-2026-113206 vulners.com
• VulDB entry 424558 vuldb.com
• Ubuntu security tracker: CVE-2026-113206 ubuntu.com
• HKCERT security bulletin on Microsoft Edge vulnerabilities www.hkcert.org
• Vulners mirror: Debian/MS advisory for CVE-2026-113206 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:04.