CVE-2026-113246 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified involves a critical memory corruption flaw within the WebKit rendering engine, specifically affecting iOSWebView components utilized by Google Chrome on Apple iOS devices prior to version 156.0.8078.47. This issue stems from improper handling of memory allocation and deallocation processes during the parsing or execution of complex HTML structures. When a user navigates to a maliciously crafted webpage, the browser's engine attempts to process specific DOM elements or script objects that trigger an out-of-bounds read condition. The root cause lies in a failure to properly validate array indices or buffer lengths before accessing memory regions associated with these web content processes. This type of flaw is characteristic of improper input validation where the software does not sufficiently verify user-supplied data against expected boundaries, leading to unauthorized access to adjacent memory locations that should remain isolated from the current execution context.
From a technical perspective, this vulnerability falls under the category of out-of-bounds read vulnerabilities as defined by Common Weakness Enumeration (CWE) standards, specifically CWE-125 which describes an out-of-bounds read where data is accessed beyond the end or before the beginning of the intended buffer. The severity is classified as medium within the Chromium security framework because while it allows for memory disclosure rather than immediate code execution, the implications are significant in a mobile environment. By exploiting this flaw, a remote attacker can craft an HTML page that forces the browser to leak sensitive data from adjacent memory spaces into the webpage's JavaScript context or other accessible variables. This capability effectively bypasses some of the sandboxing protections intended to isolate web content from the rest of the operating system and user data.
The operational impact of this vulnerability centers on information disclosure within a constrained environment. Although iOS employs strict sandboxing mechanisms that limit what each application can access, memory corruption bugs in core components like WebKit can sometimes allow attackers to read portions of the process's heap or stack. This could potentially expose session tokens, authentication cookies, private keys stored in memory, or other sensitive user data if such information resides in adjacent memory blocks at the time of exploitation. The attack vector is remote and requires no special privileges from the victim beyond visiting a malicious website, making it highly feasible for targeted phishing campaigns or drive-by download attacks where social engineering is used to lure users into loading the exploit page.
To mitigate this risk, immediate action must be taken by updating Google Chrome on iOS devices to version 156.0.8078.47 or later, which includes patches addressing these memory management errors in the underlying WebKit engine. Users should ensure that automatic updates are enabled for their browser applications to receive security fixes promptly as they become available. Additionally, organizations deploying mobile browsers on corporate devices should enforce strict content security policies and consider using enterprise mobility management solutions that can restrict access to untrusted web domains or enforce secure browsing modes that limit script execution capabilities. Awareness training regarding the risks of visiting unknown websites remains a critical layer of defense against such exploitation attempts.