Google Chrome: Use-after-free in WebAppInstalls allows code execution
Summary
Google Chrome desktop builds before 156.0.8078.47 contain a use-after-free flaw in the WebAppInstalls component, which handles Progressive Web App installation. A remote attacker can potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires user interaction, such as opening the page, but no authentication. NVD rates the issue CVSS 9.6 (critical), while Google rates it Medium.
Affected
- Google Chrome desktop builds before 156.0.8078.47 (Linux)
- Google Chrome on Windows and macOS before 156.0.8078.48 (per third-party summary; confirm with vendor)
- Chromium-based browsers such as Microsoft Edge (fix: 156.0.4314.42 or later)
- The official CVE record's version range is inconsistent (156.0.8078.47 to < 156.0.8078.47); verify with the vendor
- Linux distributions: status unclear (Debian DSA 6577-1 conflicts with OSV 'No fix available'; Ubuntu lists chromium-browser as not affected because it uses the snap)
Fixed in
- Google Chrome 156.0.8078.47 or later (Linux)
- Google Chrome 156.0.8078.48 or later (Windows, macOS; verify in vendor advisory)
- Microsoft Edge 156.0.4314.42 or later
- Debian: Unknown until the Debian tracker is checked
Workaround
- No vendor workaround for unpatched Chrome builds is known.
- Updating is the only confirmed remedy.
Exploitation
- No in-the-wild exploitation reported in the sources reviewed.
- A GitHub vulnerability tracker lists it as not in CISA KEV; this was not verified against the catalogue.
- No public proof of concept found.
- The linked Chromium issue describes a different kind of bug (protocol handler registration), so the exact nature of the defect is unknown.
Our recommendation
- Inventory Chrome, Edge and Chromium installations, including Linux snap and Debian packages, and check their versions.
- Update to the fixed versions and fully restart the browser, since a pending update prompt may leave the old process running.
- Check Linux distribution status with the respective security trackers.
- Monitor CISA KEV and the Chromium bug tracker for changes.
- Roll out the full Chrome 156 update, which contains many other security fixes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 515440087 issues.chromium.org
- NVD record via Vulners vulners.com
- HKCERT: Microsoft Edge multiple vulnerabilities www.hkcert.org
- Ubuntu CVE tracker ubuntu.com
- OSV Debian listing osv.dev
- GitHub CVE tracker entry github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:26.
Original description (NVD)
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.