CVE-2026-113199 in Chrome
Summary
by MITRE • 10/21/2026
Out of bounds read in Payments in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as an out-of-bounds read within the Payments component of Google Chrome prior to version 156.0.8078.47 represents a significant memory safety flaw that undermines the browser's core isolation mechanisms. This type of error typically occurs when software reads data from a memory location beyond the intended boundaries of a buffer or array, often due to improper index validation or miscalculated offsets during processing operations. In the context of Chrome’s Payments subsystem, which handles sensitive financial transactions and user payment credentials, such an oversight allows for unauthorized access to adjacent memory regions that should remain inaccessible to web content. The Chromium security team has classified this issue with a medium severity rating, reflecting its potential impact on confidentiality while acknowledging existing mitigations like sandboxing that may limit the immediate exploitability of the flaw in many scenarios.
From a technical perspective, out-of-bounds reads are categorized under CWE-125, which describes situations where software reads past the end of an allocated buffer. This vulnerability arises because the Payments module failed to adequately verify array indices or pointer arithmetic before accessing memory contents. When a remote attacker crafts a malicious HTML page containing specific JavaScript payloads designed to trigger this condition within the browser's rendering engine, they can force the application to retrieve data from outside its designated scope. Because Chrome employs a multi-process architecture with strict sandboxing for renderer processes, the primary defense against such vulnerabilities is preventing arbitrary code execution or full system compromise. However, even within these constrained environments, an out-of-bounds read can still be leveraged to leak sensitive information stored in memory, such as session tokens, authentication cookies, or potentially parts of payment data structures if they reside in accessible adjacent memory blocks.
The operational impact of this vulnerability centers on the potential for unauthorized data exfiltration rather than direct code execution. An attacker who successfully exploits this flaw through a crafted webpage could read arbitrary bytes from the browser's process memory space. This capability aligns with ATT&CK technique T1005, which involves Data from Local System being collected via application layer protocols or local file access mechanisms adapted for web-based attacks. While the sandbox restricts what can be done with this leaked data, it does not entirely prevent information disclosure. Sensitive user data, including potentially partial credit card numbers, billing addresses, or internal browser state variables, could be extracted and transmitted to a remote server controlled by the attacker. This compromises the confidentiality of user interactions and undermines trust in the secure handling of financial transactions within the browser environment.
Mitigation strategies for this vulnerability primarily involve updating Google Chrome to version 156.0.8078.47 or later, where these memory safety issues have been addressed through code hardening and improved bounds checking logic. Users should ensure automatic updates are enabled to receive security patches promptly as they become available. For organizations managing large deployments of browsers, centralized update management systems can be utilized to enforce patch compliance across all endpoints. Additionally, while no specific configuration changes eliminate the risk entirely, employing additional layers of defense such as content security policies and strict script execution restrictions can reduce the attack surface by limiting the types of scripts that can run within browser contexts. Regular auditing of third-party extensions is also recommended, as malicious or compromised extensions could potentially interact with vulnerable components in unexpected ways. Maintaining up-to-date software remains the most effective countermeasure against memory corruption vulnerabilities like out-of-bounds reads.