CVE-2026-113255 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free condition within Google Chrome for Android, specifically affecting versions prior to 156.0.8078.47, represents a critical memory management flaw in the CustomTabs component. This class of vulnerabilities arises when software continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, the defect resides within the handling of custom tabs, which are used to display web content within an application without fully launching Chrome. The flaw allows for the manipulation of memory states where previously allocated and subsequently deallocated objects remain accessible through dangling pointers. This situation creates a window of opportunity for remote attackers who can craft malicious HTML pages designed to trigger this specific sequence of events during tab lifecycle management.
From a technical perspective, the exploitation vector involves a crafted HTML page that interacts with the CustomTabs API in a manner that forces Chrome to free memory associated with an object while retaining references to it elsewhere in the execution context. When the application subsequently attempts to access or manipulate these objects through the stale pointers, it operates on invalid memory addresses. This misuse of freed memory can lead to arbitrary code execution within the browser's sandboxed environment. The severity is classified as medium by Chromium security standards because, while the vulnerability allows for code execution inside the sandbox, the containment mechanisms typically prevent immediate escalation to full system compromise without additional exploitation steps targeting other vulnerabilities or privilege escalation techniques.
The operational impact of this vulnerability is significant due to its remote exploitability and the widespread adoption of Chrome on Android devices. An attacker can distribute a malicious link via email, messaging applications, or compromised websites. Upon visiting the crafted page, the browser processes the content in a way that triggers the use-after-free condition. Successful exploitation results in arbitrary code execution within the context of the browser process. Although modern browsers employ robust sandboxing to limit the impact of such exploits, achieving code execution inside the sandbox is often considered a stepping stone for more severe attacks, including data exfiltration or further privilege escalation if combined with other vulnerabilities. This undermines user trust and poses risks to sensitive information processed within mobile applications that utilize Chrome's rendering engine.
To mitigate this risk, users must update Google Chrome on Android to version 156.0.8078.47 or later immediately upon availability through the official Play Store updates. For enterprise environments utilizing managed browsers, administrators should ensure that device management policies enforce automatic updates for browser components. Additionally, security awareness training can help mitigate social engineering aspects of such attacks by warning users against interacting with untrusted links from unknown sources. From a development standpoint, this incident highlights the importance of rigorous memory safety checks and lifecycle management in web view implementations. Industry standards such as CWE-416, which classifies use-after-free errors, emphasize the need for proper pointer invalidation after deallocation to prevent dangling references. Furthermore, defense-in-depth strategies aligned with MITRE ATT&CK techniques related to initial access and execution should be employed, including network monitoring for suspicious traffic patterns associated with exploit kits targeting browser vulnerabilities.