CVE-2026-113130 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free condition within the Actor component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management error that can be exploited by remote attackers to achieve arbitrary code execution. This specific flaw occurs when an object is deallocated from memory but remains accessible through dangling pointers, allowing subsequent operations to interact with freed or potentially reallocated memory regions. In the context of Chromium-based browsers, such vulnerabilities are particularly dangerous because they reside within components that process web content, making them directly reachable via maliciously crafted HTML pages hosted on remote servers. The severity is classified as low by Chromium security standards, likely due to existing sandboxing mechanisms and mitigations like heap metadata protection or ASLR, which raise the bar for successful exploitation despite the underlying technical flaw being severe in isolation.
From a technical perspective, use-after-free vulnerabilities stem from improper lifecycle management of objects within the application's memory space. When an Actor object is destroyed but references to it persist elsewhere in the codebase, subsequent access attempts can lead to undefined behavior. An attacker leveraging this condition can manipulate the contents of the freed memory block, which may be reused for other purposes by the browser engine. By carefully crafting a payload within a malicious HTML page, an adversary can control the data written into these reclaimed memory regions. This control allows for precise manipulation of program execution flow, potentially leading to arbitrary code execution with the privileges granted to the Chrome process sandbox.
The operational impact of this vulnerability is significant despite its low severity rating in internal tracking systems. A successful exploit would allow a remote attacker to bypass browser security boundaries and execute commands within the restricted environment of the renderer process. While modern browsers employ multiple layers of defense, including site isolation and strict origin policies, any breach into the sandbox can serve as an initial foothold for further attacks such as data exfiltration or lateral movement if additional vulnerabilities are chained together. The ability to trigger this flaw via a simple HTML page means that drive-by download scenarios remain viable threats, where users could be compromised simply by visiting a malicious website without needing to interact with suspicious downloads or installers.
Mitigation strategies primarily involve updating the browser software to versions 156.0.8078.47 and later, which contain patches addressing the memory management logic within the Actor component. Organizations should enforce automated update policies for all endpoints running Google Chrome to ensure timely application of security fixes. Additionally, users are advised to exercise caution when visiting untrusted websites and consider enabling enhanced protection features such as Safe Browsing or sandboxing extensions that limit the potential impact of any successful exploitation attempts. Security teams should also monitor for indicators of compromise related to memory corruption exploits in browser processes, utilizing endpoint detection and response tools capable of identifying anomalous behavior patterns associated with use-after-free attacks.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-416, which describes Use After Free conditions as a distinct class of software weaknesses leading to unpredictable system states. Furthermore, the exploitation technique maps to MITRE ATT&CK tactic T1203, specifically referencing Exploitation for Client Execution, where attackers leverage vulnerabilities in client-side applications like web browsers to gain initial access or execute malicious code on target systems. Understanding these mappings helps security professionals prioritize remediation efforts and align defensive measures with established industry frameworks for threat mitigation and vulnerability management.