CVE-2026-113283 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified involves a critical memory corruption flaw within the CredentialProvider component of Google Chrome on Windows systems prior to version 156.0.8078.47. This specific defect resides in a module responsible for handling authentication credentials, which is integral to the browser's interaction with operating system-level security features and saved login data. The nature of this flaw allows for memory corruption, specifically indicating issues such as buffer overflows or use-after-free conditions that compromise the integrity of allocated memory structures during normal operation.
From an operational perspective, this vulnerability presents a significant risk because it can be triggered by a remote attacker through a crafted HTML page. This implies that no user interaction beyond visiting a maliciously designed website is required to exploit the flaw. The attacker constructs a webpage containing specific code or scripts that interact with the CredentialProvider in a way that triggers the memory corruption error. Because this component often operates with higher privileges than standard web content, successfully exploiting this vulnerability allows an attacker to execute arbitrary code outside the browser's sandbox environment.
The ability to escape the sandbox is particularly dangerous as it bypasses one of Chrome's primary defense mechanisms designed to limit the damage caused by exploits. By executing code outside the sandbox, an attacker gains a level of access that can lead to full system compromise. This could result in unauthorized data exfiltration, installation of persistent malware, or further lateral movement within a network if the compromised machine is part of a larger infrastructure. The severity rating of Medium reflects both the potential for remote code execution and the specific context of the affected component, which while critical, may have certain constraints that prevent immediate full system takeover in all scenarios without additional exploitation steps.
This vulnerability aligns with Common Weakness Enumeration categories such as CWE-120 Buffer Copy without Checking Size of Input or CWE-416 Use After Free, depending on the exact mechanism of memory corruption observed during analysis. In terms of the MITRE ATT&CK framework, this exploit technique relates to techniques involving client-side code execution and potentially privilege escalation if the sandbox escape leads to higher-level system access. The attack vector is classified as remote with low complexity regarding user interaction, emphasizing the need for immediate patching.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, which contains patches addressing this memory corruption issue in the CredentialProvider module. Organizations should ensure that automatic updates are enabled to minimize the window of exposure. Additionally, implementing strict content security policies and restricting access to untrusted web pages can reduce the likelihood of encountering such crafted HTML pages. Security monitoring tools should be configured to detect unusual behavior from browser processes attempting to interact with credential management systems in unexpected ways, providing an additional layer of defense against exploitation attempts while patches are being deployed across endpoints.