CVE-2026-113080 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free flaw within the WebAppInstalls component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management error that can be leveraged by remote attackers to achieve arbitrary code execution within the browser's sandboxed environment. This type of vulnerability arises when a program continues to use a pointer after it has been freed, leading to undefined behavior that security researchers and threat actors alike exploit for malicious purposes. In this specific instance, the flaw resides in how Chrome handles web application installations, where memory allocated for managing these installation states is prematurely deallocated while still being referenced by other parts of the browser's execution context.
From a technical perspective, use-after-free vulnerabilities are particularly dangerous because they allow an attacker to manipulate heap metadata or overwrite adjacent objects with controlled data. When the freed memory block is reallocated for a different purpose, such as rendering content from a crafted HTML page, the attacker can inject shellcode or exploit primitives that facilitate control over program execution flow. The presence of this flaw in WebAppInstalls suggests that the issue may be triggered through specific interactions with web applications being installed via standard browser APIs, where an attacker crafts a malicious webpage designed to trigger the race condition or improper state management that leads to the dangling pointer dereference.
The operational impact of this vulnerability is severe due to its potential for remote code execution despite Chrome's robust sandboxing mechanisms. Although modern browsers employ multiple layers of defense including memory protection features like ASLR and DEP, a successful exploitation of a use-after-free flaw can often bypass these mitigations through heap spraying techniques or specific gadget chains that lead to arbitrary read/write primitives. Once an attacker gains the ability to execute code within the browser process sandbox, they may attempt further privilege escalation attacks to break out of the sandbox entirely, potentially gaining access to sensitive user data, credentials, and system resources on the victim's machine.
This vulnerability aligns with CWE-416, which defines use-after-free as a class of software vulnerabilities resulting from improper memory management practices that allow an attacker to execute arbitrary code or cause denial-of-service conditions by accessing freed memory regions. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this exploit path relates to techniques involving initial access through crafted content and subsequent execution phases where the browser process is compromised. The Chromium project has classified this issue with a Low severity rating, which typically reflects the difficulty of exploitation or the limited scope of impact under default configurations, yet it remains a significant risk given the widespread usage of Chrome and its role as a primary vector for web-based attacks.
Mitigation strategies primarily involve updating to Google Chrome version 156.0.8078.47 or later, where this memory management error has been corrected by ensuring proper lifecycle management of objects within the WebAppInstalls module. Developers should also implement rigorous code review processes focusing on pointer validity checks and ensure that all allocated resources are properly released only after they are no longer referenced anywhere in the application logic. Additionally, enabling advanced browser security features such as Site Isolation can help limit the blast radius if a vulnerability is successfully exploited by restricting cross-origin data access within the same process space.