CVE-2026-113050 in Chrome
Summary
by MITRE • 10/21/2026
Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as an out-of-bounds read within the Human Interface Device subsystem of Google Chrome prior to version 156.0.8078.47 represents a critical memory safety flaw that undermines the browser's sandboxing architecture. This specific defect occurs when the application processes input data from HID devices, which are commonly used for peripherals such as keyboards, mice, and game controllers. The root cause lies in improper boundary checks during the parsing or handling of device-specific reports, allowing an attacker to trigger a read operation that accesses memory locations outside the intended buffer limits. This type of error is classified under CWE-125, which denotes out-of-bounds read vulnerabilities, indicating a failure by the software to validate input data against allocated memory boundaries before performing access operations.
The operational impact of this vulnerability is significant due to its potential for remote exploitation through standard web interactions. An attacker can craft a malicious HTML page that leverages JavaScript APIs or specific browser features designed to interact with HID devices. When an unsuspecting user visits this crafted webpage, the embedded code triggers the vulnerable logic within the Chrome engine. Because the flaw allows reading memory inside the sandbox, it potentially enables information disclosure attacks where sensitive data stored in adjacent memory regions can be exfiltrated. This could include session cookies, authentication tokens, or other private user data that resides near the targeted buffer in memory space. The severity is rated as medium by Chromium security standards because while exploitation requires specific conditions and may not always lead to full code execution, it successfully bypasses isolation mechanisms intended to contain malicious activity within a restricted environment.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1005, which covers Data from Local System, specifically the sub-technique for data staged or collected via memory scraping. The exploitation vector is classified as remote, meaning no physical access to the victim's machine is required beyond the ability to visit a malicious website. This highlights the ongoing challenge browsers face in balancing functionality with security, particularly when integrating hardware interfaces that require deep system access. Attackers can utilize this flaw for targeted espionage campaigns or initial access phases in broader intrusion sets where stealthy data exfiltration is prioritized over disruptive actions.
Mitigation strategies primarily involve immediate software updates to ensure the browser version is at least 156.0.8078.47 or later, as these versions contain patches that enforce stricter memory boundary checks and improve input validation within the HID handling routines. For organizations managing large fleets of endpoints, automated patch management systems should be configured to prioritize this update due to its remote exploitability. Additionally, users can reduce their attack surface by disabling unnecessary browser permissions related to device access or using extensions that restrict JavaScript interactions with hardware interfaces when not strictly required. Security teams should also monitor for indicators of compromise associated with memory scraping techniques and ensure endpoint detection systems are tuned to detect anomalous memory read patterns originating from browser processes.