CVE-2026-113010 in Chrome
Summary
by MITRE • 10/21/2026
Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as an out-of-bounds read within the Extensions component of Google Chrome prior to version 156.0.8078.47 represents a significant memory safety flaw that undermines the browser's sandboxing mechanisms. This type of error typically occurs when software reads data from a memory location beyond the intended boundaries of a buffer or array, often due to insufficient validation of index values or pointer arithmetic during runtime operations. In the context of Chrome Extensions, which are complex web applications running with elevated privileges relative to standard webpage content, such an oversight can allow malicious code executed within the extension environment to access sensitive data structures that should remain isolated from untrusted sources. The severity is classified as medium by Chromium security standards because while it does not directly lead to arbitrary code execution in most scenarios, it facilitates information disclosure which serves as a critical stepping stone for more severe attacks.
From a technical perspective, this vulnerability leverages the principle of an out-of-bounds read, formally categorized under CWE-125: Out-of-bounds Read in common weakness enumerations. The flaw likely stems from improper bounds checking when processing extension-related data structures, such as manifest files, background scripts, or injected content scripts. When a crafted HTML page triggers specific interactions with the extension APIs or internal components, it can cause the browser to read memory contents that lie outside the allocated buffer space. This access bypasses normal security controls because extensions often operate in contexts where they have broader access to local resources and user data than standard web pages. By exploiting this condition, an attacker can leak stack variables, heap metadata, or other sensitive information residing adjacent to the targeted buffer, effectively breaking the isolation guarantees provided by Chrome's multi-process architecture.
The operational impact of this vulnerability centers on unauthorized memory disclosure rather than direct system compromise. An remote attacker could construct a malicious HTML page designed to trigger the specific code path containing the flaw when visited by a user with affected extensions installed or active. Upon successful exploitation, the attacker gains the ability to read arbitrary memory locations inside the browser sandbox. This capability can be used to extract sensitive information such as session cookies, authentication tokens, private keys stored in extension storage, or internal state data that reveals how other components are functioning. While the immediate risk is confidentiality loss, this type of vulnerability is frequently utilized in conjunction with other exploits to achieve arbitrary code execution through techniques like heap spraying and ROP chain construction, thereby escalating the threat from information disclosure to full system compromise if additional vulnerabilities exist within the same process or across processes via side-channel attacks.
Mitigation strategies for this issue primarily involve immediate software updates and defensive coding practices. Users must upgrade Google Chrome to version 156.0.8078.47 or later, where the bounds checking logic has been corrected to prevent access beyond allocated memory regions. For developers creating extensions, it is crucial to implement rigorous input validation and ensure that all array accesses are preceded by explicit length checks against declared buffer sizes. Security teams should also monitor for indicators of exploitation related to unusual memory read patterns in browser processes and consider deploying content security policies that restrict the execution context of untrusted scripts within extension environments. Furthermore, enabling Chrome's built-in sandboxing features and keeping them updated ensures that even if such a vulnerability is present, its impact remains contained within isolated process boundaries, reducing the likelihood of successful exploitation leading to broader system compromise as described in MITRE ATT&CK techniques related to memory corruption and information gathering.