CVE-2026-113114 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free flaw within the SignIn component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management error that can be leveraged by remote attackers to achieve arbitrary code execution. This specific defect occurs when the application continues to reference a pointer to a memory block after that block has been freed, leading to undefined behavior during runtime operations. In the context of web browsers, such flaws are particularly dangerous because they reside within components that process untrusted content from the internet, making them prime targets for exploitation through maliciously crafted web pages.
The technical root cause lies in the lifecycle management of objects associated with user authentication and sign-in processes. When a user interacts with a webpage or when background scripts execute authentication flows, memory is allocated to handle session tokens, credentials, or UI state updates. If the application fails to properly nullify pointers after deallocation or if it accesses these dangling references due to race conditions or logic errors in the rendering engine's handling of sign-in dialogs and callbacks, an attacker can manipulate the heap layout. By carefully crafting a HTML page that triggers this specific sequence of allocation and freeing followed by access, the attacker gains control over how the freed memory is interpreted. This often allows for arbitrary read/write primitives, which are foundational steps in bypassing modern browser security mitigations such as ASLR and DEP.
From an operational impact perspective, while Chromium classified this vulnerability with a Low severity rating, the potential consequences remain severe if successfully exploited. A successful exploit could allow a remote attacker to execute arbitrary code within the context of the Chrome sandbox. Although the sandbox restricts access to sensitive system resources, achieving code execution inside it is often sufficient for further privilege escalation or lateral movement in enterprise environments. The attack vector requires only that a victim visits a crafted HTML page, which aligns with common phishing and drive-by download tactics used by advanced persistent threats. This underscores the importance of timely patching even for vulnerabilities deemed low severity, as exploit complexity can vary significantly based on browser version and operating system specifics.
This vulnerability maps directly to CWE-416, Use After Free, a category of software defects where pointers are not updated after memory is released, leading to unpredictable behavior. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK Tactic TA0002 Execution and specifically supports the exploitation path for Remote Code Execution (RCE). The ability to execute code via a web page also touches upon aspects of Client-Side Attacks found in the browser-based attack vector. Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, where these memory management issues have been resolved by developers through rigorous code reviews and fuzzing efforts. Additionally, organizations should enforce strict content security policies and utilize sandboxed environments for browsing untrusted web content to minimize the blast radius of any potential exploitation attempts.