CVE-2026-113187 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described constitutes a critical memory safety flaw within the Document Object Model implementation of Google Chrome, specifically identified as an out-of-bounds use or use-after-free condition prior to version 156.0.8078.47. This type of defect arises when the browser retains a reference to a DOM element that has already been deallocated from memory by the garbage collector or explicit script execution. When subsequent operations attempt to access this stale pointer, the application interacts with freed memory regions, leading to undefined behavior that can be exploited for malicious purposes. The Chromium project classified this issue as having medium security severity, indicating it is a significant risk but potentially mitigated by default browser protections in some contexts, though not all.
From a technical perspective, use-after-free vulnerabilities are among the most dangerous classes of memory corruption errors because they allow an attacker to control how freed memory is interpreted and utilized. In the context of web browsers, DOM elements are complex objects with associated metadata and pointers. If an attacker can trigger deallocation while maintaining a reference through crafted JavaScript or HTML structures, they may manipulate heap contents during subsequent allocations. This manipulation can lead to arbitrary code execution by overwriting function pointers or vtables within the browser process memory space. The exploit chain typically involves precise timing attacks where the freed memory is reallocated with attacker-controlled data before the stale pointer is dereferenced, effectively hijacking control flow within the renderer process.
The operational impact of this vulnerability is severe despite its medium classification in some contexts because it enables remote code execution via a crafted HTML page. An adversary hosting or linking to malicious content can trigger the flaw without any user interaction beyond visiting the webpage. This capability bypasses many traditional security boundaries, allowing the attacker to execute arbitrary commands within the sandboxed renderer process. While modern browsers employ multiple layers of defense such as site isolation and memory protection mechanisms like ASLR and DEP, successful exploitation of a use-after-free in DOM can potentially lead to sandbox escape or direct compromise of the user system if other mitigations are bypassed. This represents a significant threat vector for drive-by download attacks and phishing campaigns aiming at high-value targets.
Industry standards categorize this flaw under CWE-416, which defines Use After Free as a critical weakness in software development that leads to memory corruption. The attack technique aligns with MITRE ATT&CK techniques related to exploitation of binary vulnerabilities and potentially privilege escalation if the sandbox is breached. To mitigate such risks, organizations must ensure rapid deployment of browser updates to patch these memory safety issues. Developers should also adopt secure coding practices that emphasize smart pointers and rigorous lifecycle management for DOM objects to prevent dangling references. Security teams should monitor for indicators of compromise associated with exploit kits targeting known Chrome vulnerabilities and enforce strict content security policies to limit the execution environment of untrusted scripts.