CVE-2026-113151 in Chrome
Summary
by MITRE • 10/21/2026
Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as an out-of-bounds read within the Actor component of Google Chrome prior to version 156.0.8078.47 represents a significant breach in memory safety protocols that can be exploited by remote attackers. This flaw resides deep within the browser's rendering and execution engine, specifically affecting how data is accessed during the processing of web content. When an attacker constructs a malicious HTML page containing specially crafted scripts or embedded objects, they can trigger conditions where the application attempts to read from a memory location outside the bounds of the allocated buffer. Because this operation occurs within the context of the browser's sandboxed environment, successful exploitation allows for information disclosure that bypasses standard security boundaries designed to isolate web content from system resources.
From a technical perspective, out-of-bounds reads are classified under CWE-125 in the Common Weakness Enumeration framework, which describes situations where software reads data past the end or before the beginning of the intended buffer. In the context of Chromium-based browsers, such vulnerabilities often stem from complex interactions between JavaScript engines and native code components like V8 or Blink. The Actor component likely handles specific types of media processing, animation states, or DOM manipulation tasks that involve dynamic memory allocation. If input validation is insufficient or if there are race conditions in how pointers are managed, an attacker can craft a payload that forces the browser to dereference invalid addresses. While modern browsers employ various mitigations such as ASLR and DEP, these do not prevent information leakage; they only make exploitation more difficult by randomizing memory layouts. The severity is rated as Medium because while it does not directly allow arbitrary code execution or full system compromise in its basic form, the ability to read sandboxed memory can lead to further attacks through techniques like heap spraying or side-channel analysis.
The operational impact of this vulnerability centers on confidentiality and potential downstream exploitation. A remote attacker who convinces a user to visit the crafted HTML page could potentially extract sensitive data stored within the browser's process space. This might include cookies, session tokens, autofill information, or other credentials that are accessible via JavaScript but protected by same-origin policies. By leaking memory contents across sandbox boundaries, the attacker gains insights into the internal state of the application and possibly other tabs if they share similar memory regions. Although the immediate impact is limited to data exfiltration rather than remote code execution, this capability significantly degrades user privacy and security posture. It also serves as a stepping stone for more severe attacks, where leaked pointers can be used to bypass ASLR or corrupt heap structures in subsequent stages of an exploit chain.
To mitigate risks associated with such vulnerabilities, it is critical to ensure that all instances of Google Chrome are updated to version 156.0.8078.47 or later immediately upon availability. This update contains patches for the underlying memory management issues within the Actor component. Users should enable automatic updates where possible to reduce exposure windows. Additionally, security teams can enforce policies that restrict access to untrusted web content by utilizing enterprise-grade browser configurations and sandboxing tools like Google's Site Isolation feature, which further isolates processes from one another. From a defensive development standpoint, this incident reinforces the importance of rigorous static analysis and fuzz testing in software engineering practices to detect out-of-bounds accesses before deployment. The ATT&CK framework categorizes such memory corruption techniques under T1074, specifically relating to data staged or collected for exfiltration, highlighting the need for robust endpoint detection and response capabilities that monitor for anomalous memory access patterns indicative of exploitation attempts.