CVE-2026-113075 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free issue within the DevTools component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management flaw that undermines the browser's sandboxing mechanisms. This specific class of error occurs when a program continues to use a pointer after the memory it points to has been freed, leading to undefined behavior that can be exploited by malicious actors. In this context, the DevTools interface, which is primarily intended for developers debugging web pages, contained logic errors where references to previously deallocated objects were retained and subsequently accessed. This flaw allows an attacker who crafts a specific HTML page containing malicious scripts or embedded content to trigger the premature release of memory resources while maintaining active references to those same resources elsewhere in the application's execution flow.
From a technical perspective, this vulnerability falls under the Common Weakness Enumeration category CWE-416, which defines use after free as a condition where an object is referenced after its lifetime has ended. The exploitation vector involves a remote attacker hosting or distributing a specially crafted HTML page that forces the browser to execute code paths leading to the premature deallocation of DevTools-related memory structures. When the application subsequently attempts to access these freed memory blocks, it may interpret stale data as valid instructions or pointers. This misinterpretation can lead to arbitrary code execution within the context of the Chrome process. Although Chrome employs a multi-process architecture with sandboxing to limit the impact of such exploits, sophisticated attackers can leverage this vulnerability to escape the sandbox boundary, thereby gaining higher privileges on the underlying operating system and potentially compromising the entire host environment.
The operational impact of this vulnerability is severe due to its potential for remote code execution without user interaction beyond visiting a malicious webpage. The Chromium security team has classified this issue with a medium severity rating, reflecting the complexity required to exploit it reliably across different systems but acknowledging the high risk if successful exploitation occurs. An attacker could use this flaw to install malware, steal sensitive data such as cookies and session tokens, or establish persistent access to victim machines. The presence of DevTools in standard Chrome builds means that while the attack surface is somewhat narrower than core rendering engine flaws, it remains accessible through normal browsing activities where users might visit compromised websites or fall for phishing campaigns designed to trigger this specific memory corruption state.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, which includes patches that correct the memory management logic within DevTools and prevent the use of freed pointers. Organizations should enforce automated update policies to ensure all endpoints are running patched versions promptly. Additionally, security teams can employ application whitelisting and strict content security policies to restrict the execution of untrusted scripts on internal networks. Monitoring for anomalous process behavior or unexpected network connections originating from Chrome processes can also help detect potential exploitation attempts in real-time. It is crucial to recognize that while sandboxing provides a vital layer of defense, it is not impenetrable against well-crafted exploits targeting memory corruption vulnerabilities like this one, making timely patch management the most effective defensive measure aligned with industry best practices for vulnerability remediation.