CVE-2026-113198 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free condition within the Extensions component of Google Chrome prior to version 156.0.8078.47 represents a critical memory management flaw that undermines the browser's sandboxing mechanisms. This type of error occurs when an application continues to use a pointer after the memory it points to has been freed, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, the flaw resides in how Chrome handles resources associated with its extension system, which is designed to isolate web content and limit the potential damage from compromised pages. The presence of such a vulnerability indicates a lapse in reference counting or memory lifecycle management within the code responsible for processing extension-related data structures.
A remote attacker could exploit this weakness by hosting a specially crafted HTML page that triggers the premature deallocation of an object while references to it are still active elsewhere in the browser process. When the browser attempts to access these dangling pointers, it may interpret corrupted memory contents as valid instructions or data. This misinterpretation allows for arbitrary code execution within the context of the Chrome renderer process. Although modern browsers employ robust sandboxing techniques such as site isolation and hardware-enforced stack protection, a successful exploitation of this use-after-free vulnerability can potentially bypass these defenses if the attacker manages to control the memory layout sufficiently to redirect execution flow.
The operational impact of this vulnerability is severe due to its remote exploitability via standard web interactions. An attacker does not need physical access or user interaction beyond visiting a malicious webpage, which significantly lowers the barrier for exploitation in phishing campaigns or drive-by download attacks. If successful, the ability to execute arbitrary code inside the sandbox allows an adversary to escalate privileges within the browser process, potentially leading to full system compromise depending on subsequent exploit steps such as sandbox escapes. The Chromium security severity rating of Medium reflects that while the vulnerability is serious and requires immediate attention, it may have certain constraints or mitigations in place by default that make exploitation more difficult than a high-severity issue, though this does not diminish the urgency for remediation given the potential consequences.
To mitigate the risks associated with this vulnerability, users must upgrade to Google Chrome version 156.0.8078.47 or later immediately upon availability. This update contains patches that correct the memory management logic within the Extensions component, ensuring that objects are properly retained until they are no longer needed and preventing access to freed memory regions. Security administrators should also enforce strict content security policies and consider disabling unnecessary extensions to reduce the attack surface. Additionally, keeping all browser components updated is essential as it ensures that other potential vulnerabilities in related subsystems are addressed concurrently.
From a classification perspective, this vulnerability aligns with CWE-416, which describes use after free errors where memory is accessed after being freed without proper reallocation or nullification of the pointer. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques related to initial access and execution within confined environments. The exploitation vector falls under remote code execution via web-based attacks, highlighting the importance of maintaining up-to-date software defenses against memory corruption vulnerabilities that remain a prevalent threat in modern application development.