CVE-2026-113119 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described constitutes a critical use-after-free flaw within the network handling subsystem of Google Chrome on Windows, specifically affecting versions prior to 156.0.8078.47. This type of memory corruption error occurs when a program continues to use a pointer after the memory it points to has been freed and potentially reallocated for other purposes. In the context of browser architecture, such flaws are particularly dangerous because they can allow an attacker to manipulate how the browser interprets network data or internal state structures. The severity is classified as high by Chromium security standards due to the potential for arbitrary code execution, which represents a complete compromise of the user's system integrity if exploited successfully.
The technical mechanism behind this vulnerability involves improper management of memory lifecycles within the network stack. When an HTML page containing crafted malicious content triggers specific network requests or responses, the browser may free certain data structures prematurely while retaining references to them. If an attacker can control the contents that are allocated into those freed memory regions through subsequent operations, they can achieve arbitrary read and write capabilities. This capability is crucial for bypassing modern security mitigations such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), allowing the injection of shellcode or other malicious payloads into the process space.
The operational impact of this vulnerability is severe because it enables remote code execution via a simple web page visit, requiring no user interaction beyond loading the crafted HTML document. Although Chrome employs sandboxing to limit the damage an attacker can cause from within the browser process, successful exploitation of a use-after-free in the network layer often allows for sandbox escape techniques. These techniques typically involve leveraging kernel vulnerabilities or exploiting race conditions to gain higher privileges outside the restricted environment. Consequently, this vulnerability poses a significant risk to users who visit malicious websites, potentially leading to full system compromise, data theft, and installation of persistent malware without their knowledge or consent.
From a classification perspective, this issue aligns with CWE-416, which defines use after free as a software error where the program uses memory that has already been freed. It also relates to ATT&CK technique T1203, Exploitation for Client Execution, as it relies on tricking users into executing code through client-side applications like web browsers. The attack vector is primarily remote and involves social engineering elements such as phishing or drive-by downloads where the victim is induced to load a malicious webpage that triggers the vulnerability in their browser's network processing engine.
Mitigation strategies focus heavily on timely patching, as Google has released version 156.0.8078.47 specifically addressing this flaw by correcting the memory management logic within the affected components. Organizations and individual users should ensure that Chrome is updated to at least this version immediately upon availability. Additionally, defense-in-depth measures such as enabling site isolation features in Chrome can help mitigate some risks associated with cross-site attacks, although they do not fully prevent exploitation of low-level memory corruption bugs like use-after-free. Security awareness training remains essential to reduce the likelihood of users interacting with malicious web content that attempts to exploit this or similar vulnerabilities.