CVE-2026-113155 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free flaw within the Glic component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management error that can be exploited by remote attackers to achieve arbitrary code execution. This type of vulnerability occurs when a program continues to use a pointer after it has been freed, leading to undefined behavior that security researchers and threat actors leverage to manipulate the application's control flow. In this specific instance, the flaw resides in Glic, which is part of Chromium’s rendering engine infrastructure responsible for handling various web content processing tasks. The severity is classified as medium by the Chromium project, indicating a significant risk profile despite not being categorized at the highest tier of criticality due to potential mitigating factors or exploitation complexity inherent in the sandbox environment.
The operational mechanism involves an attacker crafting a malicious HTML page that triggers specific JavaScript operations leading to premature memory deallocation while references to that memory remain active within the browser’s execution context. When the browser attempts to access this freed memory block, it may read stale data or write to unintended locations depending on how the heap is managed and whether new allocations have reused the same memory address. This scenario creates an opportunity for a remote attacker who can trick a user into visiting the crafted webpage via phishing links, malicious advertisements, or compromised websites. The attack vector relies heavily on social engineering elements combined with technical exploitation of the browser’s rendering pipeline to gain initial foothold within the process space.
The impact of successfully exploiting this vulnerability extends beyond simple data corruption as it allows for arbitrary code execution inside the sandboxed environment where Chrome typically isolates web content from the host operating system. While modern browsers employ multiple layers of defense including hardware-enforced stack canaries, address space layout randomization, and strict sandboxing policies to limit the blast radius of such exploits, a successful use-after-free condition can still lead to sandbox escape under certain conditions or result in severe compromise if combined with other vulnerabilities. The attacker could potentially install malware, steal sensitive information stored within the browser profile, monitor user activity, or pivot further into internal networks depending on the victim’s configuration and security posture.
From a classification perspective, this vulnerability aligns closely with CWE-416 which defines use after free as an error where software uses memory after it has been freed, often leading to crashes or arbitrary code execution. In terms of offensive cybersecurity frameworks such as MITRE ATT&CK, the exploitation phase corresponds to techniques involving memory corruption and potentially sandbox escape if the isolation boundaries are breached. The initial access vector falls under T1566 which covers phishing attacks used to deliver malicious payloads through deceptive web content. Understanding these mappings helps security teams prioritize patching efforts based on both technical severity and likelihood of real-world exploitation in targeted campaigns against enterprise environments or high-value individuals.
Mitigation strategies primarily focus on timely application of vendor-provided updates as Google has released version 156.0.8078.47 specifically addressing this issue through code fixes that ensure proper memory lifecycle management within the Glic component. Organizations should enforce automated update policies for all endpoints running Chrome to minimize exposure windows during which unpatched versions remain vulnerable. Additionally, implementing application whitelisting and restricting JavaScript execution capabilities on sensitive systems can reduce the attack surface even if a vulnerability exists in the browser engine itself. Security awareness training remains crucial as many successful exploits still depend on users interacting with malicious links or downloading files from untrusted sources despite technical safeguards being present in modern browsers.