CVE-2026-113045 in Chrome
Summary
by MITRE • 10/21/2026
Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as an out-of-bounds read within the Offline component of Google Chrome on Android represents a significant memory safety flaw that undermines the browser's core isolation mechanisms. This issue, resolved in version 156.0.8078.47 and classified with a Medium security severity by Chromium, stems from improper bounds checking during data processing operations associated with offline web content handling. When an attacker constructs a malicious HTML page designed to exploit this specific logic error, they can trigger the browser to access memory locations that lie outside the intended buffer boundaries. This type of vulnerability is fundamentally categorized under CWE-125, which defines out-of-bounds read errors where software reads data past the end or before the beginning of the intended buffer. The presence of such a flaw indicates a lapse in rigorous input validation and boundary verification within the code responsible for managing offline storage states or related web APIs.
The operational impact of this vulnerability is particularly concerning due to its potential to bypass Chrome's sandboxing architecture, which is designed to restrict untrusted content from accessing sensitive system resources or other process memory spaces. By leveraging a crafted HTML page served remotely, an attacker can induce the browser engine to perform unauthorized read operations on adjacent memory regions. While out-of-bounds reads typically result in information disclosure rather than arbitrary code execution, they provide attackers with valuable intelligence about the internal state of the application and potentially sensitive data stored within those memory segments. This capability allows for sophisticated attacks that may lead to further exploitation chains or privacy violations, as the attacker can extract cryptographic keys, session tokens, or other confidential user data residing in the sandboxed environment. The ability to read arbitrary memory effectively weakens the trust boundary between untrusted web content and protected system resources.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection via Client-side Scripting and potentially Data from Information Repositories if specific offline data stores are targeted. The attack vector is classified as remote, requiring only user interaction to load the malicious page, which places it within the initial access or execution phases depending on how the payload is delivered. Security researchers emphasize that such memory corruption bugs often arise from complex interactions between JavaScript engines and native C++ components in Chromium-based browsers. The offline functionality introduces additional complexity because it must manage persistent storage states while maintaining strict isolation guarantees, creating opportunities for logic errors when handling edge cases or malformed inputs during synchronization processes.
Mitigation strategies primarily involve updating to the patched version of Google Chrome on Android, which incorporates fixes that enforce stricter memory access controls and validate buffer indices before performing read operations. Developers should also review similar code paths in offline management modules to ensure consistent application of bounds checking principles across all data retrieval functions. For end-users, maintaining up-to-date browser versions is critical as these patches are deployed automatically through standard update channels. Additionally, employing content security policies that restrict the loading of external scripts and resources can reduce the attack surface by limiting the ability of remote pages to execute arbitrary code or interact with sensitive APIs in ways that might trigger such vulnerabilities. Organizations should also consider implementing network-level filtering to block known malicious domains hosting exploit kits until all endpoints are verified as patched against this specific memory safety issue.