Google Chrome: Memory corruption in WebRTC allows code execution in sandbox
Summary
A memory corruption flaw in the WebRTC component of Google Chrome desktop versions before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker may be able to execute arbitrary code inside the browser sandbox. The attack requires a user to visit a malicious page, and no authentication is needed. Google rates the issue as Critical in its Chromium security severity field.
Affected
- Google Chrome desktop versions before 156.0.8078.47 (CVE description)
- The exact oldest affected version is unknown.
- The official CVE record lists the range inconsistently, so the vendor notice should be checked.
Fixed in
- Google Chrome 156.0.8078.47 or later (Linux, per secondary reporting of the vendor notice)
- Google Chrome 156.0.8078.47 or later for Windows and macOS (secondary reporting lists .47 and .48; verify against Google's notice)
- Debian and FreeBSD have published Chromium updates for this issue.
Workaround
Unknown. No workaround is documented beyond installing the update and restarting the browser.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
- Google's announcement does not state that the bug is exploited; bug details may remain restricted until most users are patched.
Our recommendation
- Update Google Chrome to 156.0.8078.47 or later on all endpoints this month.
- Verify the installed version on each device, because the browser may keep running the old build until restarted.
- Check Chromium-based packages on Linux workstations and servers, such as Debian's chromium package.
- Monitor for updates from Microsoft Edge and other Chromium-based browsers.
- Verify the CVSS score and affected range in the live NVD record before reporting them.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Cybersecurity News: Chrome security update fixing 353 flaws cybersecuritynews.com
- Penligent: Chrome 156 security update www.penligent.ai
- VulDB entry vuldb.com
- Vulners CVE-2026-113303 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:08.
Original description (NVD)
Memory corruption in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.