CVE-2026-113043 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified involves a use-after-free error within the WebKit rendering engine, which serves as the core browser technology for Google Chrome on iOS devices prior to version 156.0.8078.47. This specific memory management flaw occurs when the application continues to reference a pointer after that memory has been deallocated or freed by the system. In the context of web rendering, this typically happens during complex DOM manipulation or JavaScript execution where an object is destroyed while still being accessed by another part of the codebase. Because WebKit handles the parsing and layout of HTML content, any crafted webpage designed to trigger this race condition can cause the browser to execute instructions based on stale memory addresses rather than valid data structures.
From a technical perspective, use-after-free vulnerabilities are particularly dangerous because they allow an attacker to control what happens when the freed memory is reallocated or accessed. If an attacker can predict how the operating system will reuse that specific block of memory, they can inject malicious code into it. When the vulnerable component subsequently accesses this memory location under the guise of normal operation, it inadvertently executes the injected payload. This mechanism bypasses many traditional security controls because the execution occurs within a context that appears legitimate to the browser's internal logic, even though the underlying data has been compromised.
The operational impact of this vulnerability is significant due to its potential for remote code execution via a crafted HTML page. A user does not need to download any files or interact with suspicious executables; simply visiting a malicious website hosted by an attacker can trigger the exploit. Although Google Chrome on iOS operates within a sandboxed environment, which limits the scope of damage compared to desktop versions, successful exploitation still allows for arbitrary code execution inside that sandbox. This means an attacker could potentially access sensitive user data stored locally by the browser, such as cookies, cached credentials, or browsing history, and exfiltrate it to remote servers controlled by the adversary.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use-after-free conditions resulting from improper memory management practices in software development. The exploitation technique maps directly to MITRE ATT&CK tactic T1203, specifically sub-technique 1203.2 for exploit public code or frameworks, and relates to initial access vectors where malicious content is delivered via web-based methods. Security researchers classify this with a medium severity rating in the Chromium security framework because while it requires user interaction (visiting the page) and operates within sandbox constraints, its ability to achieve arbitrary code execution makes it a serious threat vector for mobile device compromise.
Mitigation strategies primarily involve immediate software updates to ensure that all iOS devices running Google Chrome are upgraded to version 156.0.8078.47 or later, where the memory management logic in WebKit has been patched to prevent access to freed memory blocks. For organizations deploying mobile applications, enforcing strict update policies is critical to closing this window of exposure. Additionally, users should be educated on the risks of visiting untrusted websites and utilizing browser security features such as sandboxing protections that isolate web content from core system resources. While technical mitigations like heap hardening can reduce exploitability, patching remains the only definitive solution for eliminating the root cause in the affected software version.