Google Chrome: Memory corruption in BFCache allows sandboxed code execution
Summary
Google Chrome desktop builds before 156.0.8078.47 contain a memory corruption flaw in BFCache, Chrome's back/forward page cache. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. Exploitation requires a user to visit the page (UI:R), and the impact is limited to the sandbox, so a sandbox escape would be needed for full compromise. The NVD status and CVSS score (8.8 in the record) could not be confirmed and should be checked before use in reports.
Affected
- Google Chrome (desktop) before 156.0.8078.47
- Google Chrome for Android before 156.0.8078.47 (secondary reporting, not confirmed by vendor)
- Microsoft Edge (Chromium-based) before 156.0.4314.42 (HKCERT bulletin)
Fixed in
- Chrome 156.0.8078.47 is the minimum fixed version.
- Deploy the newest stable Chrome 156.x build. Other Chrome 156 CVEs list 156.0.8078.79 as fixed; the current build could not be confirmed.
- Downstream: Debian (DSA 6577-1, DLA 4853-1) and FreeBSD have published fixes for chromium. Ubuntu lists its chromium-browser packages as not affected; check the Chromium snap channel separately.
Workaround
- Unknown. No workaround for BFCache was found in the sources.
- Not needed if the patched version is installed.
Exploitation
- No evidence of exploitation in the wild found. No CISA KEV listing found; confirm directly against CISA KEV.
- No public proof-of-concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Chrome and Edge to the newest stable 156.x build on all endpoints.
- Verify the installed version on each endpoint, and restart the browser so the update takes effect.
- Make sure automatic updates work and check managed deployments.
- Prioritise staff who browse untrusted sites.
- Check the NVD entry for the current CVSS score before using it in reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium bug tracker issue 520017400 issues.chromium.org
- Vulners: CVE-2026-113265 vulners.com
- VulDB: CVE-2026-113265 vuldb.com
- Ubuntu Security: CVE-2026-113265 ubuntu.com
- HKCERT security bulletin: Microsoft Edge multiple vulnerabilities www.hkcert.org
- Strix: CVE-2026-113265 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:26.
Original description (NVD)
Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.