Google Chrome: Memory corruption in Controls allows sandbox code execution
Summary
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in the Controls component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the victim must open the page. Google rates the issue Low, while NVD scores it CVSS 8.8.
Affected
- Google Chrome desktop for Linux before 156.0.8078.47
- Google Chrome desktop for Windows and macOS before 156.0.8078.48 (per secondary reporting)
- Google Chrome for Android before 156.0.8078.47
- Chromium-based products that have not yet ingested the fix (e.g. Microsoft Edge, see Edge advisory)
Fixed in
- Linux and Android: Chrome 156.0.8078.47 or later
- Windows and macOS: Chrome 156.0.8078.48 or later (based on secondary sources; vendor advisory not verified)
Workaround
Unknown.
No mitigation is documented beyond updating. Restart the browser after updating, because a running process can keep the old code.
Exploitation
- CISA SSVC assessment lists exploitation as "poc", meaning a proof of concept is assumed to exist. Automatable: no. Technical impact: total.
- No evidence of exploitation in the wild found. No CISA KEV listing found in the research.
Our recommendation
- Update Chrome to 156.0.8078.47 (Linux, Android) or 156.0.8078.48 (Windows, macOS) or later.
- Restart browsers after updating and verify the installed version, including on managed devices.
- Check Chromium-based products such as Microsoft Edge separately.
- Re-check the CISA KEV catalogue before closing the item.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- Vulners CVE record CVE-2026-113331 vulners.com
- Ubuntu CVE tracker CVE-2026-113331 ubuntu.com
- Hong Kong CERT bulletin: Microsoft Edge multiple vulnerabilities www.hkcert.org
- Cybersecurity News: Chrome security update fixing 353 flaws cybersecuritynews.com
- TechGeeks: Security notice Google Chrome 156 stable www.techgeeks.org
- Wikipedia: Google Chrome en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:53.
Original description (NVD)
Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.