CVE-2026-113053 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free flaw within Google Chrome for Android, specifically affecting versions prior to 156.0.8078.47, represents a critical memory management error in the browser's cookie handling subsystem. This type of defect occurs when the application attempts to access or manipulate memory that has already been deallocated by the system. In this specific instance, the Chromium engine failed to properly invalidate references to cookie objects after they were freed, leaving dangling pointers within the internal data structures used for managing user session and tracking cookies. When a remote attacker constructs a malicious HTML page designed to trigger this sequence of events, the browser processes the crafted content in a way that causes it to reuse the memory location previously occupied by the now-freed cookie object. This misuse of freed memory allows an adversary to inject arbitrary data into the heap, which can subsequently be interpreted as executable code or control flow instructions during subsequent operations on the same memory block.
From a technical perspective, this vulnerability falls under the Common Weakness Enumeration category CWE-416, known as Use After Free. The exploitation mechanism relies heavily on precise timing and heap grooming techniques to ensure that the attacker-controlled data is allocated in the exact memory slot previously occupied by the cookie object. Once this condition is met, the browser's execution context reads or writes through the dangling pointer, effectively allowing an untrusted web page to bypass standard security boundaries. Although Chromium classifies the severity of this issue as Low, likely due to mitigations such as sandboxing and other exploit mitigation techniques like ASLR and DEP that make reliable exploitation difficult, the underlying flaw remains a significant risk vector for remote code execution attacks targeting mobile devices running affected Chrome versions.
The operational impact of successfully exploiting this vulnerability is severe, potentially leading to arbitrary code execution within the browser's sandboxed environment. While modern browsers employ robust isolation mechanisms between tabs and processes, achieving initial code execution inside the sandbox can serve as a stepping stone for further privilege escalation or data exfiltration attacks. An attacker could leverage this flaw to steal sensitive user information such as authentication tokens stored in cookies, bypass security policies, or install malware on the device if additional vulnerabilities are chained with this entry point. The ability to execute arbitrary code via a crafted HTML page means that users do not need to interact beyond visiting a malicious website, making it a viable vector for drive-by download attacks and targeted phishing campaigns aimed at Android users.
To mitigate the risks associated with this vulnerability, organizations and individual users must ensure that Google Chrome on Android is updated to version 156.0.8078.47 or later immediately upon availability. This update contains patches that correct the memory management logic within the cookie handling module, ensuring that references are properly nullified after deallocation and preventing the reuse of freed memory blocks. Additionally, security teams should monitor for indicators of compromise related to heap spraying techniques often used in conjunction with use-after-free exploits. Implementing strict content security policies and restricting script execution on untrusted domains can further reduce the attack surface by limiting the ability of malicious web pages to manipulate browser internals effectively. Regular patch management cycles are essential to address such vulnerabilities promptly, as they form a critical layer of defense against remote exploitation attempts targeting widely used software components like web browsers.