CVE-2026-113260 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described involves a memory corruption flaw within the Core component of Google Chrome, specifically affecting versions prior to 156.0.8078.47. This type of defect typically arises from improper handling of memory allocation or deallocation processes during the rendering and execution of web content. When a user visits a maliciously crafted HTML page, the browser's engine may encounter an unexpected state that triggers incorrect pointer arithmetic, buffer overflows, or use-after-free conditions within the core processing logic. Although the Chromium project has classified this security severity as Low, indicating it is less likely to be exploited in complex real-world scenarios compared to high-severity issues, memory corruption vulnerabilities remain critical because they form the foundation for many advanced attack chains that lead to arbitrary code execution.
The operational impact of this vulnerability centers on the potential for a remote attacker to execute arbitrary code within the browser's sandboxed environment. Modern browsers utilize multi-process architectures and sandboxes to isolate web content from the underlying operating system, thereby limiting the damage an exploited page can cause. However, if memory corruption allows an attacker to manipulate control flow or data structures sufficiently, they may be able to bypass these isolation mechanisms. This could result in the execution of malicious payloads with the privileges granted to the browser process, potentially leading to further privilege escalation attacks against the host system. The ability to execute code via a crafted HTML page means that no user interaction beyond visiting a compromised website is required, making this an effective vector for drive-by download attacks or initial access campaigns targeting users who browse untrusted content.
From a technical classification perspective, this vulnerability aligns with Common Weakness Enumeration categories such as CWE-120 Buffer Copy without Checking Size of Input and CWE-416 Use After Free, depending on the specific nature of the memory corruption observed in the Core component. In terms of adversary tactics, exploitation attempts would likely fall under MITRE ATT&CK techniques related to Initial Access via Spearphishing Link or Drive-by Compromise, followed by Execution through Browser-based mechanisms. The low severity rating suggests that while the flaw exists and is technically exploitable, it may require specific conditions or additional vulnerabilities in adjacent components to achieve a reliable exploit chain against patched systems with current security mitigations enabled.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, where the underlying memory management issues have been addressed by the development team. Organizations should ensure that automatic updates are enabled for all endpoints running this browser to minimize exposure windows. Additionally, security teams can employ application control policies and sandboxing solutions to further restrict what code executed within the browser context is permitted to do on the host system. Monitoring network traffic for unusual outbound connections following visits to untrusted sites can also help detect potential exploitation attempts in real-time. Regular vulnerability assessments and patch management cycles are essential to maintaining a secure posture against such memory corruption flaws that persist across software versions until explicitly remediated by vendors.