CVE-2026-113061 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as memory corruption within the Chromium-based Chromoting component represents a significant risk vector for users of Google Chrome versions prior to 156.0.8078.47. This flaw resides in the code responsible for handling remote desktop connections, specifically during the processing of data structures that manage screen updates and input events. The root cause is classified under CWE-122, which denotes a heap-based buffer overflow condition. In this specific context, an attacker can craft a malicious HTML page containing specially constructed JavaScript or embedded media elements that trigger improper bounds checking within the Chromoting module. When the browser processes these crafted inputs, it writes data beyond the allocated boundaries of a memory buffer on the heap. This out-of-bounds write corrupts adjacent memory structures, potentially overwriting critical metadata such as object headers or function pointers associated with other objects in the same allocation zone.
The operational impact of this vulnerability is severe due to its potential for remote code execution within the browser's sandbox environment. Although Chromium employs a multi-process architecture and strict sandboxing policies designed to limit the damage caused by exploits, memory corruption vulnerabilities like heap overflows can often be leveraged through sophisticated exploitation techniques such as heap spraying or use-after-free chaining to bypass these protections. By carefully manipulating the corrupted memory state, an attacker may achieve arbitrary code execution with the privileges of the compromised browser process. This effectively allows a remote attacker to take control of the user's system if they successfully trick a victim into visiting the malicious webpage via phishing campaigns, drive-by downloads, or compromised legitimate websites that host third-party content containing the exploit payload.
From an attack perspective, this vulnerability aligns with MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution. The attacker relies on social engineering to induce the user to load the crafted HTML page, after which the browser automatically executes the malicious code without further interaction. The severity is rated as low by Chromium security standards primarily because modern versions of Chrome have implemented advanced mitigation strategies such as Control Flow Integrity (CFI), Heap Metadata Protection, and strict sandboxing that make exploitation significantly more difficult compared to older releases. However, the existence of a reliable exploit path remains a critical concern for enterprise environments where users may inadvertently navigate to malicious sites or receive phishing emails containing links to these crafted pages.
Mitigation strategies must focus on immediate patch management as well as defensive configuration adjustments. The primary and most effective remediation is to update Google Chrome to version 156.0.8078.47 or later, which contains the necessary code fixes to validate buffer boundaries correctly before writing data. For organizations unable to immediately deploy patches across all endpoints, network-level controls such as web proxy filtering can be configured to block access to known malicious domains hosting exploit kits. Additionally, enabling Google Chrome's Site Isolation feature ensures that each website is loaded into a separate process with its own sandboxing context, thereby limiting the blast radius of any successful exploitation attempt. Security awareness training for users regarding phishing risks remains essential as technical controls alone cannot prevent all initial access vectors involving social engineering.