CVE-2026-113000 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as a memory corruption flaw within the rendering engine of Google Chrome prior to version 156.0.8078.47 represents a critical security risk that undermines the browser's sandboxing mechanisms. This specific defect resides in the Paint component, which is responsible for handling graphical operations and visual output during page rendering. The severity of this issue is classified as High by Chromium security standards due to its potential to facilitate arbitrary code execution within an isolated environment where such access should be strictly prohibited.
The technical nature of this flaw involves improper memory management practices that allow a remote attacker to corrupt the state of the application's memory space. By crafting a malicious HTML page containing specially designed scripts or embedded objects, an adversary can trigger specific conditions in the Paint module that lead to buffer overflows, use-after-free errors, or other heap corruption scenarios. These memory inconsistencies provide the necessary foothold for injecting and executing arbitrary machine code. The sophistication of this attack vector lies in its ability to bypass standard security controls by exploiting the complex interactions between JavaScript execution contexts and native rendering processes.
From an operational perspective, successful exploitation allows a remote attacker to execute commands with the privileges of the browser process. Although Chrome employs sandboxing to limit the impact of such breaches, breaking out of this container can lead to full system compromise depending on the operating system's security posture and additional mitigations in place. This vulnerability enables phishing campaigns, drive-by downloads, and further lateral movement within a network if the compromised machine is part of an enterprise environment. The ability to execute arbitrary code remotely makes this a prime target for automated exploitation kits distributed across malicious websites or embedded in email attachments that trigger browser rendering upon opening.
Industry standards categorize such vulnerabilities under CWE-120 Buffer Copy without Checking Size of Input and CWE-416 Use After Free, depending on the specific memory corruption mechanism triggered within the Paint module. In terms of offensive security frameworks like MITRE ATT&CK, this exploit aligns with techniques involving Initial Access via Browser Exploitation and Privilege Escalation through Sandbox Escape. The attack path typically involves T1189 Drive-by Compromise followed by T1055 Process Injection or T1218 System Binary Proxy Execution if the attacker manages to leverage the executed code for further persistence or evasion.
Mitigation strategies primarily involve immediate patching of all affected Chrome installations to version 156.0.8078.47 or later, which contains the necessary fixes for the memory handling logic in the Paint component. Organizations should enforce automated update policies to ensure rapid deployment of security patches across user endpoints. Additionally, deploying endpoint detection and response solutions can help identify anomalous behavior associated with browser-based exploits, such as unexpected process creation or unusual network connections originating from Chrome processes. Users are advised to exercise caution when visiting untrusted websites and to disable unnecessary plugins that may interact with the rendering engine in ways that could exacerbate memory safety issues until updates are applied.