CVE-2026-113165 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described involves a use-after-free condition within the core rendering engine of Google Chrome on macOS, specifically affecting versions prior to 156.0.8078.47. This class of memory corruption error occurs when an application continues to use a pointer after the memory it points to has been freed and potentially reallocated for another purpose. In the context of web browsers, such flaws are particularly dangerous because they can be triggered by maliciously crafted HTML pages served from remote servers. The attacker constructs a webpage containing specific JavaScript or DOM manipulation sequences that cause the browser's internal objects to deallocate memory while references to those objects remain active in other parts of the application state. When these dangling pointers are subsequently accessed, the program reads or writes data at an arbitrary location in memory rather than crashing immediately, which provides the attacker with a mechanism for control flow hijacking.
From a technical perspective, this flaw represents a classic instance of CWE-416, Use After Free. The vulnerability likely stems from improper lifecycle management of internal browser objects where reference counting or garbage collection mechanisms fail to invalidate pointers correctly upon deallocation. When the renderer process executes code derived from an untrusted source, it may trigger conditions that free critical data structures while other threads or event handlers still hold references to them. This race condition allows for arbitrary read and write primitives within the sandboxed environment of the browser's rendering process. Although Chrome employs a multi-process architecture with strict sandboxes designed to limit the impact of such exploits, sophisticated attackers can leverage use-after-free vulnerabilities to escape these restrictions through techniques like heap spraying or specific gadget chains that manipulate memory layout to achieve code execution outside the intended security boundaries.
The operational impact of this vulnerability is severe despite its classification as medium severity by Chromium standards. A successful exploitation allows a remote attacker to execute arbitrary code within the context of the browser process. While modern browsers isolate rendering tasks, achieving arbitrary code execution in any component can serve as a stepping stone for sandbox escape attacks. If an attacker successfully exploits this flaw, they could potentially bypass security controls such as site isolation and read-only memory protections, leading to full system compromise depending on how effectively the specific exploit chain bridges the gap between the renderer process and more privileged processes or the host operating system. This poses significant risks including data theft, installation of persistent malware, and unauthorized access to sensitive user information stored locally by the browser.
Mitigation strategies primarily involve immediate software updates. Users running Google Chrome on macOS must upgrade to version 156.0.8078.47 or later where this memory management issue has been resolved through improved pointer invalidation and stricter checks during object lifecycle transitions. In environments where patching is not immediately feasible, network-level controls such as web application firewalls can be configured to block requests containing known exploit patterns associated with use-after-free triggers in Chromium-based browsers. Additionally, enabling Chrome’s built-in sandbox features ensures that even if an exploitation attempt occurs, the potential damage is contained within a restricted environment. Security teams should also monitor for indicators of compromise related to memory corruption exploits and ensure that endpoint detection and response systems are updated to recognize behavioral signatures associated with heap manipulation attacks typical of this vulnerability class mapped under MITRE ATT&CK technique T1203 Exploitation for Client Execution.