CVE-2026-113056 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the Performance APIs of Google Chrome, specifically in versions prior to 156.0.8078.47, represents a critical memory corruption flaw that undermines the browser's sandboxing mechanisms. This issue stems from improper handling of data structures during performance metric collection and processing operations. When a user visits a maliciously crafted HTML page containing specially designed JavaScript code, the browser attempts to parse and execute instructions related to resource timing and navigation metrics. Due to insufficient bounds checking or type confusion within the underlying C++ implementation of these APIs, an attacker can trigger a write-what-where condition or heap overflow. This memory corruption allows for arbitrary read and write operations in memory regions that are typically isolated from untrusted web content by Chrome's multi-process architecture.
The operational impact of this vulnerability is severe because it facilitates the escape from the browser sandbox. Modern browsers rely on strict isolation between renderer processes, which execute untrusted web content, and higher-privilege process contexts such as the GPU or utility processes. By exploiting a memory corruption flaw in the Performance API, an attacker can manipulate pointers to redirect execution flow into these protected areas. This effectively bypasses security controls like Control Flow Integrity (CFI) and Data Execution Prevention (DEP), allowing for arbitrary code execution with elevated privileges on the victim's system. The severity is classified as low by Chromium standards likely due to the complexity of chaining this memory corruption with other vulnerabilities to achieve a reliable sandbox escape, but in practice, it poses a significant risk if combined with additional exploitation techniques or specific browser configurations that weaken isolation boundaries.
From an industry standard perspective, this vulnerability aligns closely with CWE-120 Buffer Overflow and CWE-787 Out-of-bounds Write, which describe the fundamental memory safety failures involved. Furthermore, the attack vector relates to ATT&CK technique T1203 Exploitation for Client Execution, where attackers use malicious files or web content to execute code on a target system. The exploitation of browser APIs like Performance is consistent with techniques observed in advanced persistent threats that aim to establish persistence or move laterally within an enterprise network after initial compromise through phishing or drive-by downloads.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, where the underlying memory management logic for performance metrics has been corrected to enforce strict bounds checking and type safety. For organizations unable to patch immediately, deploying browser isolation solutions or web application firewalls that filter out suspicious JavaScript patterns targeting performance APIs can provide a layer of defense. Additionally, enabling Chrome's Site Isolation feature ensures that sensitive data is not shared across origins, reducing the potential blast radius if an exploit succeeds. Security teams should also monitor for indicators of compromise associated with memory corruption exploits in browser processes and ensure that endpoint detection and response tools are configured to detect anomalous behavior indicative of sandbox escape attempts.