CVE-2026-113091 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free condition within the PerformanceAPIs component of Google Chrome on Android represents a critical memory management flaw that was addressed in version 156.0.8078.47. This type of error occurs when a program continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In the context of web browsers, such vulnerabilities are particularly dangerous because they reside within the sandboxed environment designed to isolate untrusted code from the underlying operating system and user data. The specific component involved, PerformanceAPIs, is responsible for providing JavaScript applications with access to timing information about various performance-related events. When an attacker crafts a malicious HTML page that triggers this flaw, it can lead to arbitrary code execution within the browser's sandboxed process.
From a technical perspective, use-after-free vulnerabilities arise when memory allocated for an object is deallocated but references to that memory remain in use elsewhere in the program. If the memory allocator reuses that freed block for a different purpose before the stale reference is cleared or overwritten with safe data, the application may interpret new data as old structure information. This discrepancy can allow an attacker to control how the browser processes subsequent operations, potentially leading to heap corruption and ultimately arbitrary code execution. Although Chromium classified this vulnerability's security severity as Low, it is important to recognize that even low-severity memory safety issues in widely used software like Chrome can be leveraged for sophisticated attacks if combined with other techniques or specific environmental conditions.
The operational impact of this vulnerability centers on the potential compromise of user privacy and system integrity through remote exploitation. An attacker could host a specially crafted HTML page and trick a victim into visiting it, typically via phishing campaigns or malicious advertisements. Once executed within the browser's sandbox, the exploit attempts to escalate privileges beyond the restricted environment where web content is normally confined. While modern browsers employ multiple layers of defense such as ASLR, DEP, and site isolation, successful exploitation could still result in data exfiltration, session hijacking, or further lateral movement if additional vulnerabilities are present. The fact that this affects Android versions prior to 156.0.8078.47 highlights the importance of keeping mobile browsers updated to mitigate known risks associated with memory corruption flaws.
To align this incident with established industry standards, it maps directly to CWE-416, which defines Use After Free as a software error where a pointer is used after its associated memory has been freed. This category of vulnerability is frequently targeted in exploit development due to the high degree of control an attacker can gain over program flow and data structures. Furthermore, from the perspective of the MITRE ATT&CK framework, this type of exploitation falls under techniques related to Initial Access via Spearphishing Link or Drive-by Compromise, specifically leveraging client-side code execution within a web browser environment. The attack vector relies on social engineering elements combined with technical exploitation of the rendering engine's memory management subsystems.
Mitigation strategies primarily involve ensuring that all devices running Google Chrome are updated to version 156.0.8078.47 or later, where this specific use-after-free condition has been patched by Chromium developers. Security teams should also enforce strict content security policies and utilize browser hardening features such as site isolation to limit the blast radius of any potential exploitation attempts. Additionally, deploying advanced threat protection solutions that monitor for anomalous behavior in web processes can provide an additional layer of defense against memory corruption exploits. Regular patch management cycles are essential to address these types of vulnerabilities promptly before they can be widely exploited by malicious actors targeting mobile users.