Google Chrome: Memory corruption in Compositing component
Summary
Google Chrome for desktop contains a memory corruption flaw in the Compositing component, which assembles page content for display. A remote attacker may be able to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The attack requires the victim to load the malicious page; the CVSS 3.1 base score is 9.6 (critical).
Affected
- Google Chrome (desktop) prior to 156.0.8078.47
- Android Chrome: reported as affected by secondary sources, not confirmed by the CVE record or vendor
Fixed in
- Linux: 156.0.8078.47
- Windows and macOS: 156.0.8078.47 or .48 (per secondary reports; verify on the vendor release page)
Workaround
- No vendor-documented workaround. Apply the browser update.
- Relaunch the browser after updating and check chrome://version, because an old browser process may keep the vulnerable version active.
Exploitation
- No evidence of in-the-wild exploitation found.
- No public proof-of-concept or exploit code found.
- Not listed in CISA KEV according to an automated alert. CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Update all Chrome desktop installations to the current stable build now, starting with laptops and rarely restarted endpoints.
- Relaunch the browser after the update and verify the version.
- Check Chromium-based browsers such as Microsoft Edge and Brave, as well as managed or kiosk installations, for the fixed build.
- Recheck the CISA KEV catalogue before closing the item.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- Vulners: CVE-2026-113336 (Debian advisories) vulners.com
- Ubuntu Security: CVE-2026-113336 ubuntu.com
- Automated CVE alert (KEV and EPSS status) github.com
- Vulners: MS:CVE-2026-113336 (Microsoft Edge) vulners.com
- Cybersecurity News: Chrome 156 security update cybersecuritynews.com
- GBHackers: Google Chrome 156 fixes 353 vulnerabilities gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:22.
Original description (NVD)
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.