CVE-2026-113108 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described constitutes a critical memory safety flaw within the JavaScript engine of Google Chrome, specifically identified as an use-after-free condition in Script objects prior to version 156.0.8078.47. This type of error occurs when a program continues to use a pointer after it has been freed from memory, leading to undefined behavior that can be exploited by malicious actors. In the context of web browsers, such vulnerabilities are particularly dangerous because they reside within the sandboxed environment designed to isolate untrusted content from the host operating system and user data. The presence of this flaw indicates a failure in proper reference counting or lifecycle management for script objects during execution, allowing an attacker who crafts a malicious HTML page to trigger the dereferencing of memory that has already been released back to the allocator.
From a technical perspective, use-after-free vulnerabilities are classified under CWE-416 within the Common Weakness Enumeration standard. This classification highlights the risk associated with accessing deallocated memory regions, which can result in arbitrary code execution if the attacker can control the data written into that freed memory block before it is reallocated for another purpose. In Chromium-based browsers, the JavaScript engine manages complex object graphs and dynamic allocations during page rendering and script execution. When a script object is destroyed but references to it persist within other active structures or closures, accessing these stale pointers allows an attacker to manipulate internal browser state. The severity of this issue was rated as Medium by the Chromium security team, reflecting its potential for exploitation while acknowledging that additional conditions may be required to achieve full code execution compared to higher-severity memory corruption bugs like buffer overflows in critical rendering paths.
The operational impact of successfully exploiting this vulnerability is severe, enabling a remote attacker to execute arbitrary code within the browser's sandboxed process. Although modern browsers employ multiple layers of defense such as Control Flow Integrity (CFI), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR) to mitigate exploitation attempts, a reliable use-after-free primitive significantly increases the likelihood of bypassing these protections. Once arbitrary code execution is achieved within the sandboxed renderer process, an attacker may attempt further privilege escalation techniques to break out of the browser's security boundary and gain control over the underlying operating system. This could lead to data theft, installation of malware, or use of the compromised machine as part of a botnet. The attack vector requires only that a victim visits a crafted HTML page, making it a high-risk threat in phishing campaigns or malicious ad networks where user interaction is limited to navigation.
To mitigate this risk and prevent exploitation, users must ensure they are running Google Chrome version 156.0.8078.47 or later, as these updates contain the necessary patches for memory management logic within the Script engine. Security administrators should enforce automatic update policies across all endpoints to minimize exposure windows. Additionally, organizations can implement application control solutions that restrict the execution of unsigned scripts in high-risk environments and utilize browser hardening configurations such as disabling JavaScript where not strictly required by business processes. Monitoring network traffic for connections to known malicious domains hosting exploit kits can also provide an additional layer of defense against initial access attempts leveraging this vulnerability. The incident underscores the importance of continuous patch management and adherence to secure coding practices in web application development to prevent similar memory safety issues from being introduced into client-side software.