CVE-2026-113214 in Chrome
Summary
by MITRE • 10/21/2026
Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as an improper input validation flaw within the FullScreen API of Google Chrome prior to version 156.0.8078.47 represents a significant breach in browser-side isolation mechanisms. This specific defect allows for potential arbitrary code execution inside the sandbox, which is a critical security boundary designed to restrict the actions that untrusted web content can perform. The root cause lies in how the browser handles state transitions and input parameters when an application or webpage attempts to enter full-screen mode. Specifically, the validation logic fails to adequately sanitize or verify certain inputs provided by the HTML page requesting this privileged operation. This oversight creates a pathway for malicious actors to exploit the discrepancy between expected and actual behavior during the rendering process, leading to memory corruption or control flow hijacking within the restricted environment of the browser sandbox.
From a technical perspective, such vulnerabilities often stem from race conditions, type confusion errors, or insufficient bounds checking when processing complex DOM manipulations associated with full-screen requests. When an attacker crafts a malicious HTML page that triggers this flawed validation path, they can manipulate internal data structures used by the rendering engine. If successful, this manipulation allows the execution of arbitrary code within the context of the browser process itself. Although Chrome employs multiple layers of defense including sandboxing, ASLR, and DEP, bypassing these controls through a low-severity classification indicates that the exploit chain may rely on subtle edge cases or require specific environmental conditions to succeed. The Chromium security team has classified this issue as Low severity, suggesting that while the potential impact is high due to code execution capabilities, the complexity of exploitation or the likelihood of successful attack in real-world scenarios remains relatively limited compared to critical vulnerabilities.
The operational impact of this vulnerability extends beyond simple privilege escalation within a single tab. Successful exploitation could allow an attacker to escape the browser sandbox and potentially access sensitive user data such as cookies, session tokens, or local storage contents from other tabs if isolation boundaries are compromised further. In worst-case scenarios, it could facilitate drive-by download attacks where malicious payloads are silently installed on the victim's system without their knowledge. This undermines the fundamental trust model of web browsing, where users expect that visiting a webpage will not result in unauthorized code execution or data exfiltration. The existence of such flaws highlights the ongoing challenge browsers face in balancing feature richness with security rigor, particularly when dealing with complex APIs like FullScreen which interact deeply with both the operating system and user interface layers.
To mitigate this risk, users must ensure that their Google Chrome installation is updated to version 156.0.8078.47 or later immediately upon availability. This patch contains the necessary code changes to enforce stricter input validation rules within the FullScreen implementation, thereby closing the gap exploited by crafted HTML pages. Additionally, organizations should consider implementing Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed and disable unnecessary browser features that might expand the attack surface. Regular security audits of web applications hosted internally or externally are also recommended to identify similar input validation weaknesses before they can be weaponized by external threat actors.
This vulnerability aligns with CWE-20 Improper Input Validation, as it involves a failure to correctly validate user-supplied data before processing it within the application logic. Furthermore, from an offensive security perspective, this type of flaw is relevant to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically in contexts where attackers leverage browser vulnerabilities to execute commands or scripts on compromised systems. Understanding these mappings helps security teams prioritize patch management efforts and refine detection rules for potential exploitation attempts targeting similar input validation weaknesses across other web applications and software components.