CVE-2026-112997 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described involves a memory corruption flaw within the Cascading Style Sheets engine of Google Chrome, specifically affecting versions prior to 156.0.8078.47. This type of defect typically arises from improper handling of data structures during the parsing and rendering process of CSS rules embedded in web pages. When a browser processes complex or malformed style definitions, it may perform invalid memory operations such as out-of-bounds writes, use-after-free conditions, or buffer overflows. These errors compromise the integrity of the application's memory space, leading to unpredictable behavior that can be exploited by malicious actors. The severity is classified as medium within the Chromium security framework, indicating a significant risk but one that may require specific conditions or additional vulnerabilities for full exploitation compared to critical severity issues.
From an operational perspective, this vulnerability allows a remote attacker to potentially execute arbitrary code inside the browser's sandbox environment. Modern browsers employ strict sandboxing mechanisms designed to isolate web content from the underlying operating system and user data. However, memory corruption bugs can sometimes allow attackers to bypass these isolation boundaries or manipulate internal objects in ways that lead to code execution within the restricted context. If successful, this could enable the attacker to perform actions such as stealing sensitive information like cookies, session tokens, or saved passwords stored by the browser. It may also facilitate further attacks on the host system if the sandbox is fully compromised, although the primary impact remains focused on the client-side environment and user data privacy.
This flaw aligns with Common Weakness Enumeration categories related to memory safety violations, particularly CWE-120 Buffer Copy without Checking Size of Input or CWE-416 Use After Free, depending on the specific nature of the corruption within the CSS parser. In terms of attack vectors, it corresponds to MITRE ATT&CK techniques involving exploitation via web browsers and potentially command execution through browser-based attacks. The vulnerability highlights the ongoing challenges in maintaining secure codebases for complex rendering engines that must handle untrusted input from diverse sources on the internet.
To mitigate this risk, users are strongly advised to update Google Chrome immediately to version 156.0.8078.47 or later, where these memory management issues have been addressed by the development team. Organizations should ensure their endpoint security policies enforce automatic updates for web browsers to minimize exposure windows. Additionally, deploying browser isolation solutions or content filtering proxies can provide an additional layer of defense against malicious HTML pages designed to trigger such vulnerabilities. Security teams should also monitor for indicators of compromise related to unusual memory usage patterns in Chrome processes, which may signal active exploitation attempts targeting this specific flaw.