Google Chrome: Use-after-free in Performance component allows sandboxed code execution
Summary
Google Chrome versions prior to 156.0.8078.47 contain a use-after-free vulnerability in the Performance component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, such as opening a malicious link or visiting a compromised website, and no authentication.
Affected
- Google Chrome prior to 156.0.8078.47 (desktop)
- Chromium-based installations built from versions before 156.0.8078.47 depending on channel and platform
- Note: Scanner reports may flag 156.0.8078.47 as vulnerable due to a fixed-version mismatch (8078 vs 8087); the vendor build number is 156.0.8078.47.
Fixed in
- Chrome 156.0.8078.47 or later (Linux, Android)
- Chrome 156.0.8078.47/.48 or later (Windows, macOS)
- Debian: updates per DSA 6577-1 and DLA 4853-1
- Ubuntu: chromium-browser packages are marked not affected because they use a snap; check the snap version.
Workaround
No workaround available. Apply the update.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept known.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- CVSS ratings differ: NVD 8.8 (High), VulDB 6.3; Chromium severity Medium.
Our recommendation
- Update Chrome and other Chromium-based browsers (e.g. Edge) to 156.0.8078.47 or later on all systems.
- Restart the browser after updating so the new version is active.
- Check the Debian or snap package version on Linux hosts.
- Verify scanner findings against the vendor build number before escalating.
- Monitor the CISA KEV catalog for changes in status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- CVE description (Vulners) vulners.com
- VulDB entry vuldb.com
- Ubuntu security tracker ubuntu.com
- Wazuh false-positive issue github.com
- Grype false-positive issue github.com
- Secondary release coverage (Cybersecuritynews) cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:46.
Original description (NVD)
Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.