CVE-2026-113087 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free condition within the Actor component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management flaw that undermines the browser's sandboxing mechanisms. This specific class of error occurs when an application continues to use a pointer after the memory it points to has been freed, leading to undefined behavior that can be exploited by malicious actors. In this instance, the vulnerability resides in the Actor subsystem, which is responsible for handling various asynchronous operations and message passing within the Chromium architecture. When a crafted HTML page triggers specific sequences of events involving object lifecycle management, the browser fails to properly invalidate references to deallocated memory objects. This allows an attacker who controls the content of the webpage to manipulate these dangling pointers, effectively gaining control over how subsequent memory accesses are interpreted by the application runtime.
From a technical perspective, use-after-free vulnerabilities are particularly dangerous because they can lead to arbitrary code execution if the freed memory is reallocated and overwritten with malicious data before being accessed again. The attacker crafts an HTML page containing JavaScript or other web technologies designed to trigger this race condition or logical error within the Actor component. By carefully timing allocations and deallocations, the adversary ensures that their controlled payload occupies the same memory location previously held by a legitimate object. When the browser subsequently accesses this memory through the stale pointer, it executes instructions derived from the attacker's input rather than expected program logic. This mechanism bypasses many standard security controls because the execution flow is redirected to code injected into the process space of the renderer or potentially higher-privileged processes depending on how the Actor interacts with other components.
The operational impact of this vulnerability is severe, as it allows a remote attacker to execute arbitrary code inside the sandboxed environment where Chrome renders web content. While Chromium employs multiple layers of defense-in-depth such as site isolation and hardware-enforced stack protection, successfully exploiting a use-after-free can still lead to full compromise of the renderer process. If an attacker achieves escape from this isolated context through additional exploitation techniques or if the specific Actor implementation interacts with higher-privilege components without adequate checks, the consequences escalate to complete system takeover. The Chromium security team has classified this issue as Medium severity, indicating that while it requires user interaction via a crafted webpage and may face mitigations in default configurations, its potential for code execution makes it a significant risk vector against end-users browsing untrusted content.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use after free errors resulting from improper memory management practices. Furthermore, the exploitation path corresponds to MITRE ATT&CK technique T1203, specifically focusing on exploit code delivery and execution within a web browser context. The ability to execute arbitrary code via HTML pages highlights the persistent threat posed by sophisticated phishing campaigns or drive-by download attacks that leverage zero-day exploits in popular software like Chrome. To mitigate this risk, users must ensure their browsers are updated to version 156.0.8078.47 or later where these memory management checks have been corrected and dangling pointers are properly invalidated upon deallocation. Organizations should also enforce strict update policies for endpoint devices running Chromium-based browsers to minimize the window of exposure to such remote code execution vulnerabilities.