Google Chrome: Memory corruption in Accessibility on macOS
Summary
Google Chrome on macOS contains a memory corruption flaw (CWE-119) in the Accessibility component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the malicious page, and no authentication is required. The NVD-style CVSS 3.1 base score is 8.8 (High), while VulDB rates it 6.3 (Medium).
Affected
- Google Chrome on macOS prior to 156.0.8078.47 (per CVE description)
- Windows and Linux are not named in this CVE
- The CNA record's version range is internally inconsistent (156.0.8078.47 to < 156.0.8078.47); VulDB lists up to 155.0.8059.84
Fixed in
- Google Chrome for macOS 156.0.8078.47 or later (per CVE description)
- The exact build in the vendor advisory was not verified; the latest stable 156 build is recommended
Workaround
Unknown. No vendor workaround identified; apply the update instead.
Exploitation
- No evidence of exploitation in the wild found in the sources checked
- CISA SSVC assessment: exploitation none, not automatable
- No public proof of concept found in the sources checked
- CISA KEV status not checked
Our recommendation
- Check the Chrome version on all Mac devices (Chrome menu > Help > About Google Chrome) and update to 156.0.8078.47 or later, preferably the latest 156 build.
- Relaunch Chrome after the update, as the update applies only on restart.
- Use MDM or central management to verify patch status on Mac endpoints.
- Priority: medium-high for Mac fleets with browsing enabled.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop (20 Oct 2026) chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Vulners: NVD record CVE-2026-113317 vulners.com
- VulDB entry 424648 vuldb.com
- Vulners: PT-2026-119014 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:55.
Original description (NVD)
Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.