CVE-2026-113207 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free flaw within Google Chrome's Site Isolation mechanism on Android represents a significant breach of browser-based isolation boundaries, potentially allowing for arbitrary code execution with medium severity according to Chromium’s internal classification standards. This specific defect resides in the core process separation logic that is designed to prevent cross-site scripting and data leakage by ensuring that pages from different origins are rendered in distinct processes. When an attacker crafts a malicious HTML page specifically engineered to trigger this race condition or memory management error, they can exploit the window of time where a pointer remains valid after its underlying memory has been freed but before it is reallocated for another purpose. This scenario allows the attacker to manipulate the contents of that memory region with controlled data, effectively gaining control over program execution flow within the context of the renderer process sandbox.
From a technical perspective, this vulnerability falls under the category of CWE-416, which describes Use After Free errors where software continues to use a pointer after it has been freed, leading to undefined behavior that can be leveraged for exploitation. The operational impact is severe because Chrome’s Site Isolation feature relies heavily on strict memory safety and process boundaries to maintain security. By bypassing these safeguards through precise heap manipulation, an attacker can escape the restrictive sandbox environment that typically limits what a compromised renderer process can do. This escalation of privilege enables the execution of arbitrary code with the same permissions as the browser itself or potentially higher depending on the specific context of the exploit chain, which could lead to full device compromise if additional vulnerabilities are chained together in subsequent stages.
This type of exploitation aligns closely with MITRE ATT&CK techniques related to process injection and sandbox escape, specifically T1055 Process Injection and T1218 Signed Binary Proxy Execution or similar methods used to bypass security restrictions. The ability to execute code inside the sandbox via a crafted web page highlights the critical importance of robust memory management in complex software systems like modern browsers. Attackers often utilize such vulnerabilities as an initial foothold, leveraging them to download additional payloads, exfiltrate sensitive user data stored by the browser, or establish persistence on the affected Android device. The medium severity rating reflects that while exploitation requires a specific crafted page and potentially some level of social engineering to get the victim to visit it, the technical complexity is manageable for sophisticated threat actors who specialize in zero-day exploits.
Mitigation strategies primarily involve applying the latest security patches provided by Google Chrome prior to version 156.0.8078.47 on Android devices. Users and administrators should ensure that automatic updates are enabled or manually check for browser updates regularly to mitigate exposure to such memory corruption vulnerabilities. Additionally, employing defense-in-depth measures such as content security policies where applicable, keeping the underlying operating system updated, and using mobile device management solutions can help reduce the attack surface. Security teams should also monitor for indicators of compromise related to unusual network activity or process behavior originating from browser processes, as these may signal an active exploitation attempt targeting this specific class of vulnerabilities in Chrome’s Site Isolation architecture.