CVE-2026-113174 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free flaw within the Extensions component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management error that compromises the integrity of the browser's execution environment. This specific class of defect occurs when an application continues to use a pointer after the memory it points to has been freed, leading to undefined behavior that can be exploited by malicious actors. In this instance, the flaw resides within the extension system, which is responsible for managing third-party add-ons and their associated scripts, stylesheets, and resources. The security severity of this issue is classified as Medium by Chromium standards, indicating a significant risk profile that warrants immediate attention despite not being rated at the highest critical tier due to potential mitigating factors in default configurations or exploitation complexity.
From a technical perspective, the root cause involves improper handling of memory deallocation within the extension runtime context. When an extension script is unloaded or modified, the underlying system fails to properly nullify references to the freed memory blocks. This oversight allows subsequent operations to access stale pointers that may now point to newly allocated data structures controlled by an attacker. By crafting a specific HTML page that triggers this sequence of events through malicious JavaScript execution within an extension context, an adversary can manipulate these dangling pointers. The exploitation vector relies on convincing a user to visit the crafted webpage while having vulnerable extensions installed or active, thereby leveraging the browser's own trust model against itself.
The operational impact of successfully exploiting this vulnerability is severe, as it enables arbitrary code execution inside the sandboxed environment where Chrome typically isolates web content and extension processes. While modern browsers employ robust sandboxing mechanisms to limit the blast radius of such exploits, achieving arbitrary code execution within even a restricted context can lead to further privilege escalation or data exfiltration if additional vulnerabilities are chained together. An attacker could potentially read sensitive user data stored by extensions, modify browser behavior, or use the compromised process as a pivot point for deeper network intrusion. The ability to execute code via a crafted HTML page means that no physical access or local file system interaction is required, making this a remote attack vector with high potential for widespread impact through phishing campaigns or malicious websites hosting exploit kits.
To mitigate this risk, users and administrators must ensure that Google Chrome is updated to version 156.0.8078.47 or later as soon as possible. This update contains the necessary patches to correct the memory management logic within the Extensions component, ensuring that pointers are properly invalidated after deallocation. Additionally, organizations should enforce strict policies regarding which extensions are permitted in their environments, minimizing the attack surface by disabling unnecessary third-party add-ons. Regular auditing of installed extensions and removing those with poor security reputations or outdated code can further reduce exposure to such vulnerabilities. Monitoring for unusual network activity originating from browser processes may also help detect potential exploitation attempts before significant damage occurs.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use after free conditions resulting in undefined behavior and potential remote code execution. Furthermore, the attack methodology corresponds to techniques found in the MITRE ATT&CK framework, specifically those related to client-side exploits such as T1059 Command and Scripting Interpreter or potentially T1203 Exploitation for Client Execution depending on how the payload is delivered and executed within the browser context. Understanding these mappings helps security teams categorize the threat accurately and apply appropriate detection rules based on known adversary behaviors associated with memory corruption exploits in web browsers.