CVE-2026-113003 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described involves a critical memory corruption flaw within the Human Interface Device subsystem of Google Chrome, specifically in versions prior to 156.0.8078.47. This defect represents a significant breach in the browser's internal data handling mechanisms, allowing for unauthorized manipulation of system memory states during normal operation. The root cause lies in how the HID component processes input events and manages associated buffers, where improper validation or bounds checking leads to conditions such as buffer overflows or use-after-free scenarios. These types of memory errors are particularly dangerous because they can corrupt adjacent memory structures, potentially allowing an attacker to overwrite function pointers or control flow data within the process space.
From a technical perspective, this flaw is classified under CWE-120 Buffer Copy without Checking Size of Input and CWE-416 Use After Free, depending on the specific manifestation of the corruption in the HID handler. The vulnerability enables a remote attacker to execute arbitrary code inside the sandbox by crafting a malicious HTML page that triggers the flawed memory operations when rendered or interacted with by the browser engine. Although Chrome employs a multi-process architecture with strict sandboxing to limit the impact of such exploits, successful exploitation can allow an attacker to escape these restrictions if they manage to corrupt critical security boundaries within the renderer process and subsequently pivot into higher-privilege processes. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter for initial execution and potentially T1203 Exploitation for Client Execution, as it leverages user interaction through a web page to trigger code execution on the victim's machine.
The operational impact of this vulnerability is severe due to its remote exploitability via standard web browsing activities. An attacker does not need physical access or prior authentication; instead, they can distribute the crafted HTML page through phishing emails, compromised websites, or drive-by download scenarios. Once a user visits the malicious site, the browser automatically processes the content, triggering the memory corruption without any further action from the victim. This leads to potential full system compromise if the sandbox escape is successful, granting the attacker access to sensitive data, installation of persistent malware, or use of the device as part of a botnet. The medium severity rating assigned by Chromium reflects the complexity involved in reliably achieving code execution and escaping the sandbox, but it remains a high-risk issue given the widespread usage of Chrome and the potential for automated exploitation campaigns targeting unpatched systems.
Mitigation strategies primarily involve immediate patching to version 156.0.8078.47 or later, which addresses the underlying memory management issues in the HID component. Organizations should enforce automatic update policies across all endpoints running Google Chrome to ensure timely application of security patches. Additionally, users can employ browser hardening techniques such as disabling JavaScript on untrusted sites using extensions like NoScript or configuring enterprise-level policy settings that restrict access to potentially dangerous web content. Network monitoring solutions and endpoint detection and response systems should be configured to detect anomalous behavior indicative of memory corruption exploits, such as unusual process spawning patterns or attempts to inject code into browser processes. Regular vulnerability assessments and penetration testing can also help identify misconfigurations or outdated software versions before they are exploited by threat actors leveraging this specific flaw.