Google Chrome: Use-after-free in Core allows code execution outside sandbox

Summary

A use-after-free flaw in the Core component of Google Chrome on Android allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attack is triggered when a user opens a crafted HTML page, so no authentication is needed but user interaction is. Chromium rates the issue Medium, while the CVSS score of 9.6 reflects the assumed scope change and full impact of a sandbox escape.

Affected

• Google Chrome for Android prior to 156.0.8078.47 (per CVE description)
• Microsoft Edge prior to 156.0.4314.42 (downstream Chromium, per HKCERT)
• Debian chromium packages (covered per tracker); Ubuntu chromium-browser package is a snap installer, the Chromium snap is the update path
• Note: the CVE record's version range is internally inconsistent (156.0.8078.47 to < 156.0.8078.47); the description is used here.

Fixed in

• Google Chrome for Android: 156.0.8078.47 or later
• Google Chrome Desktop (Windows, macOS, Linux): Chrome 156 Stable release of October 20, 2026
• Microsoft Edge: 156.0.4314.42 or later
• Later Chrome 156 builds (for example Android 156.0.8078.79) are reported by third-party trackers and should include the fix; not confirmed by the vendor here.

Workaround

• Unknown. No mitigation was found in the sources; updating is the remedy.

Exploitation

• CISA KEV: not listed.
• Public proof of concept: none found.
• A secondary source reports Google stated no evidence of in-the-wild exploitation for critical bugs in this release; this is not confirmed against Google's notes and may not refer to this CVE.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Update Chrome on Android devices to 156.0.8078.47 or later; verify that Google Play auto-update is enabled or push the update via MDM, including BYOD devices.
• Update Chrome on desktops and Microsoft Edge on Windows to the Chrome 156 build containing the fix.
• Update Chromium snaps or Debian chromium packages where used.
• Prioritise this within days for mobile fleets and unrestricted browsing environments.
• Check NVD directly for the current analysis status and score.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker entry issues.chromium.org
• Ubuntu security tracker CVE-2026-113263 ubuntu.com
• Vulners CVE-2026-113263 vulners.com
• HKCERT security bulletin: Microsoft Edge multiple vulnerabilities www.hkcert.org
• Chrome 156 stable what's new (ChromeGeek) www.chromegeek.com
• Chrome release calendar (BrowserCalendar) browsercalendar.com
• CISA KEV status tracker entry (GitHub) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:25.