CVE-2026-113265 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as a memory corruption issue within the BFCache component of Google Chrome prior to version 156.0.8078.47 represents a significant risk to browser integrity and user safety. The Back-Forward Cache, commonly referred to as BFCache, is an optimization feature designed to improve navigation performance by storing complete page states in memory rather than re-fetching or re-parsing resources from the network when users navigate back or forward through their history. This mechanism allows for near-instantaneous loading of previously visited pages, preserving form data and JavaScript execution contexts. However, flaws within this caching subsystem can lead to severe security implications if not properly managed by the browser engine developers.
At its core, this vulnerability stems from improper handling of memory operations during the restoration or invalidation of cached page states. Memory corruption vulnerabilities typically arise when a program writes data beyond the boundaries of allocated buffers, accesses freed memory, or fails to initialize variables correctly before use. In the context of BFCache, such errors may occur due to race conditions between cache storage and retrieval processes, incorrect reference counting for objects retained in the cache, or mishandling of complex DOM structures during state serialization and deserialization. These technical flaws allow an attacker who crafts a malicious HTML page to trigger undefined behavior within the browser's memory space. The severity is classified as medium by Chromium security standards because while exploitation requires user interaction via visiting a crafted site, the potential for arbitrary code execution remains high if the corruption leads to control flow hijacking or data leakage.
The operational impact of this vulnerability is profound given Chrome’s widespread adoption and its role in isolating web content within sandboxes. Although modern browsers employ multiple layers of defense such as Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and sandboxing mechanisms to limit the damage caused by successful exploits, a memory corruption flaw can still bypass these protections under specific conditions. An attacker could potentially execute arbitrary code inside the browser’s process context with limited privileges initially but might escalate this access through subsequent exploit steps targeting other components or vulnerabilities within the same environment. This poses risks including unauthorized data exfiltration, installation of malware, and complete compromise of the user system if combined with additional privilege escalation techniques.
From a classification perspective, this issue aligns closely with CWE-120 Buffer Overflow without bounds checking and potentially CWE-416 Use After Free depending on the specific nature of the memory corruption observed in debugging sessions. These categories highlight fundamental programming errors that result in unstable software behavior exploitable by remote adversaries. Furthermore, within the MITRE ATT&CK framework, this vulnerability facilitates initial access techniques where attackers leverage web-based delivery mechanisms to execute code on target systems. The use of a crafted HTML page exemplifies common tactics employed in drive-by download attacks or phishing campaigns aimed at exploiting browser-side flaws rather than server-side infrastructure weaknesses.
Mitigation strategies primarily involve updating the Google Chrome installation to version 156.0.8078.47 or later, which includes patches addressing these memory management issues within BFCache. Users should enable automatic updates to ensure timely protection against newly disclosed vulnerabilities. For organizations deploying Chrome across endpoints, centralized update policies and monitoring tools can help verify patch compliance quickly. Additionally, employing browser hardening techniques such as disabling unnecessary plugins, restricting script execution in untrusted zones, and utilizing content security policies where applicable adds defensive depth that may mitigate the impact of similar future exploits even before patches are applied. Security awareness training remains crucial to prevent users from interacting with suspicious links or visiting potentially malicious websites that might attempt to trigger these vulnerabilities through social engineering tactics.