CVE-2026-113236 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free error within Google Chrome for iOS, specifically in the navigation component prior to version 156.0.8078.47, represents a critical memory management flaw that can lead to remote code execution. This issue stems from improper handling of object lifecycles during page transitions or frame navigations. In complex web environments, particularly those involving iframes and dynamic content loading, the browser must carefully track references to DOM elements and associated JavaScript objects. When a navigation event occurs, such as changing the URL or reloading a page, internal pointers that previously referenced valid memory locations may become dangling if the underlying object is deallocated while still being accessed by another part of the application logic. This specific instance in Chromium indicates that an attacker could manipulate this state to trigger access to freed memory, thereby gaining control over program execution flow.
From a technical perspective, use-after-free vulnerabilities are among the most dangerous classes of bugs because they allow attackers to corrupt heap structures or overwrite function pointers with malicious data. In the context of Chrome on iOS, which operates within strict sandboxing constraints designed by Apple and Google, exploiting this flaw requires precise timing and memory layout control. An attacker would craft a specially constructed HTML page that triggers the navigation sequence while simultaneously inducing the premature deallocation of critical objects. By carefully controlling what is allocated in the freed memory space through subsequent allocations, the attacker can achieve arbitrary read or write primitives. These primitives are essential for bypassing modern security mitigations such as ASLR and DEP, ultimately allowing the execution of arbitrary code within the browser's sandboxed environment.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via a crafted web page. Users visiting maliciously designed sites could have their devices compromised without any additional interaction beyond loading the content. Although Chrome on iOS benefits from Apple’s App Sandbox, which limits the scope of damage an application can inflict on the rest of the system, successful exploitation still poses significant risks. An attacker could potentially exfiltrate sensitive user data stored by the browser, such as cookies and session tokens, or use the compromised browser instance to pivot into other applications that share container access. Furthermore, persistent malware installation becomes a possibility if the sandbox boundaries can be breached through subsequent exploits chained with this initial vulnerability.
Industry standards classify this type of flaw under CWE-416: Use After Free, which highlights the failure to properly manage memory deallocation relative to object usage. The attack vector aligns with ATT&CK technique T1059.007: JavaScript, as it involves executing code within a web context to achieve initial access and privilege escalation within the sandboxed environment. Mitigation strategies primarily involve updating Google Chrome for iOS to version 156.0.8078.47 or later, where these memory management issues have been addressed by developers through rigorous testing and patching of the navigation logic. Additionally, users should ensure that their operating system is up to date, as newer versions of iOS often include enhanced security features like improved sandbox enforcement and heap hardening techniques that make exploitation more difficult even if a vulnerability exists. Regularly updating browser software remains the most effective defense against such remote code execution threats.