CVE-2026-113149 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a memory corruption issue within the FullScreen component of Google Chrome prior to version 156.0.8078.47 represents a significant breach in browser security architecture, specifically targeting the isolation mechanisms designed to contain malicious content. This flaw arises from improper handling of memory operations during the rendering and management of full-screen media or web applications, allowing an attacker who crafts a specific HTML page to trigger undefined behavior within the renderer process. The core technical failure lies in the incorrect allocation, use, or deallocation of memory buffers associated with the FullScreen API implementation, which can lead to heap corruption or stack overflow conditions depending on the exact nature of the exploit code. By leveraging this flaw, an attacker can manipulate the state of the browser's internal data structures to achieve arbitrary code execution within the context of the renderer process. Although Chrome employs a multi-process architecture with sandboxing to limit the impact of such exploits, achieving code execution inside the sandbox is a critical milestone for attackers as it provides them with elevated privileges relative to standard web content restrictions and serves as a stepping stone toward further system compromise if additional vulnerabilities are chained or if sandbox escape techniques are applied.
From an operational perspective, this vulnerability poses a severe risk to users who visit maliciously crafted websites that exploit the FullScreen feature. The attack vector is remote and requires no user interaction beyond visiting the targeted page, which may automatically trigger full-screen mode depending on browser settings or specific JavaScript implementations. Once executed, the arbitrary code running inside the sandbox can perform various hostile actions such as stealing sensitive cookies, session tokens, or local storage data that are typically accessible to web content but protected from external network access by default security policies. Furthermore, successful exploitation could allow the attacker to download and execute additional payloads on the victim's machine, potentially leading to full system compromise if combined with other vulnerabilities like sandbox escapes. The severity is classified as medium within the Chromium ecosystem because while it allows code execution in a restricted environment, the immediate impact is limited by the sandbox boundaries; however, given the high prevalence of Chrome and its role as a primary internet gateway for many users, even medium-severity bugs are treated with urgency due to their potential for widespread exploitation.
To mitigate this risk, organizations and individual users must ensure that Google Chrome is updated to version 156.0.8078.47 or later immediately upon availability. This patch includes corrections to the memory management routines within the FullScreen component, ensuring proper bounds checking and preventing the corruption of critical data structures during full-screen transitions. In environments where immediate patching is not feasible due to compatibility concerns, implementing strict content security policies can help reduce exposure by restricting the execution of untrusted scripts or disabling certain browser features that might be leveraged in conjunction with this vulnerability. Additionally, deploying network-level defenses such as web application firewalls and intrusion detection systems configured to detect known exploit patterns associated with memory corruption attacks can provide an additional layer of protection against remote exploitation attempts.
This incident aligns with common weakness enumerations related to improper input validation and buffer handling, specifically falling under categories that describe out-of-bounds writes or use-after-free conditions which are prevalent in complex software systems like web browsers. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with initial access through spearphishing links or drive-by downloads, where the primary goal is to establish a foothold within the target environment by exploiting client-side applications. The ability to execute arbitrary code inside the sandbox also relates to defense evasion and privilege escalation tactics if subsequent steps are taken to break out of the restricted execution context. Therefore, maintaining up-to-date software versions remains the most effective control against such vulnerabilities, as browser vendors continuously refine their security models to address these complex memory management issues that arise from the intricate interactions between web standards implementations and underlying operating system resources.