Google Chrome: Memory corruption in DevTools allows sandboxed code execution
Summary
Memory corruption in the DevTools component of Google Chrome desktop versions before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs the victim to open a crafted HTML page, which requires no login. NVD rates the issue 8.8 (High) under CVSS 3.1, while Google rates the upstream Chromium issue Low. Code execution outside the sandbox usually requires a second vulnerability.
Affected
- Google Chrome desktop builds prior to 156.0.8078.47 (per the CVE description)
- Android Chrome builds: reported by a secondary source, not confirmed by the vendor
Fixed in
- Linux: 156.0.8078.47
- Windows and macOS: 156.0.8078.48 (per research notes, to be verified against the vendor advisory)
Workaround
- No vendor workaround known. Apply the update.
- Restart the browser after updating, because the old process may still be running.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- No evidence of in-the-wild exploitation found.
- No public proof of concept found.
Our recommendation
- Update Chrome on all desktop and Android devices to the fixed version within days.
- Restart the browser after the update and verify the installed version.
- Check whether managed browsers receive updates automatically.
- Monitor for exploitation reports and update the tracker if status changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Microsoft Security Update Guide msrc.microsoft.com
- Ubuntu CVE tracker ubuntu.com
- Vulners CVE mirror vulners.com
- Chrome 156 security update overview www.penligent.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:56.
Original description (NVD)
Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.