CVE-2026-113243 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described involves a critical memory corruption flaw within the Document Object Model implementation of Google Chrome, specifically affecting versions prior to 156.0.8078.47. This defect represents a significant deviation from expected secure coding practices regarding how browser engines manage and manipulate DOM elements in memory. The core technical issue stems from improper handling of object lifecycles or pointer arithmetic during the processing of HTML content, which can lead to conditions such as use-after-free or heap buffer overflow states. When an attacker crafts a malicious webpage containing specific sequences of HTML tags and scripts designed to trigger these edge cases within the DOM parser, they can corrupt adjacent memory structures that are critical for browser stability and security isolation.
From a technical perspective, this flaw allows for arbitrary code execution by exploiting the gap between user-space application logic and kernel-level sandboxing mechanisms. Although Chrome employs rigorous sandboxing techniques like site-isolation to restrict the privileges of renderer processes, sophisticated memory corruption vulnerabilities can sometimes bypass these controls if they allow an attacker to manipulate control flow data or execute shellcode within a process that has not been fully isolated from higher-privilege components. The severity is classified as medium by Chromium security standards because while exploitation requires user interaction such as visiting a crafted page, the potential impact includes full compromise of the browser session and potentially further lateral movement if additional vulnerabilities are chained together to escape the sandbox boundary.
The operational impact of this vulnerability extends beyond simple data theft or defacement. Successful exploitation enables a remote attacker to execute arbitrary code with the privileges of the compromised renderer process. This can lead to unauthorized access to sensitive user data stored in cookies, local storage, and browser history. Furthermore, if the memory corruption allows for sandbox escape, the attacker could gain control over the host operating system, leading to complete compromise of the victim's machine. The risk is particularly acute given that modern web applications often rely heavily on dynamic DOM manipulation via JavaScript, providing ample attack surface for crafting payloads that trigger these specific memory errors during runtime execution.
Mitigation strategies primarily focus on immediate software updates and defensive browsing practices. Users must upgrade Google Chrome to version 156.0.8078.47 or later where the underlying DOM parsing logic has been patched to correctly validate object references and manage memory allocation boundaries. For organizations, enforcing automatic update policies ensures that endpoints remain protected against known exploits. Additionally, deploying browser hardening configurations such as disabling JavaScript in untrusted zones or using extensions that restrict access to certain APIs can reduce the attack surface. Security teams should also monitor for indicators of compromise related to unusual network traffic patterns originating from browser processes, which may indicate active exploitation attempts targeting this specific memory corruption flaw.
This vulnerability aligns with Common Weakness Enumeration category CWE-120 Buffer Copy without Checking Size of Input and potentially CWE-416 Use After Free, depending on the exact nature of the memory state at time of exploit. In terms of adversary tactics, it maps to MITRE ATT&CK technique T1203 Exploitation for Client Execution, where attackers leverage software vulnerabilities in client applications to gain initial access or persistence within a target environment. Understanding these mappings helps security professionals prioritize patching efforts and enhance detection rules based on known exploitation patterns associated with DOM-based memory corruption issues in web browsers.