CVE-2026-113284 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described involves a critical memory corruption flaw within the XML parsing component of Google Chrome, specifically affecting versions prior to 156.0.8078.47. This defect represents a significant deviation from expected secure coding practices in handling structured data inputs. The core technical issue stems from improper validation or bounds checking during the processing of Extensible Markup Language documents. When an attacker crafts a malicious HTML page containing specially constructed XML content, they can trigger this flaw by exploiting specific edge cases in how Chrome's rendering engine interprets and allocates memory for these structures. This type of vulnerability is classically categorized under CWE-120 Buffer Overflow or CWE-787 Out-of-bounds Write depending on the precise nature of the corruption, indicating that the application writes data beyond the intended boundaries of a allocated buffer in memory.
The operational impact of this flaw is severe due to its potential for remote code execution within the browser's sandbox environment. Modern browsers employ strict sandboxing mechanisms designed to isolate web content from the underlying operating system and user files. However, if an attacker can successfully exploit this memory corruption vulnerability, they may be able to overwrite critical control data such as return addresses or function pointers. This allows them to redirect program execution flow, potentially bypassing security mitigations like Data Execution Prevention and Address Space Layout Randomization. The Chromium project has classified the security severity of this issue as High, reflecting its potential for widespread exploitation through standard web browsing activities without requiring user interaction beyond visiting a malicious site.
From an offensive security perspective, this vulnerability aligns with techniques observed in advanced persistent threats and drive-by download attacks. It maps directly to MITRE ATT&CK technique T1203 Exploitation for Client Execution, where attackers leverage software vulnerabilities on client systems to execute arbitrary code. The attack vector is classified as remote via the network (ATT&CK T1190), meaning no physical access or local authentication is required. An attacker simply needs to host a crafted HTML page and lure a victim with an outdated version of Chrome to visit it. Once executed, the malicious payload can establish persistence, exfiltrate sensitive data, or serve as a foothold for further lateral movement within a network if the browser's sandboxing fails completely.
Mitigation strategies primarily focus on immediate software updates and defensive configuration adjustments. The most effective remediation is upgrading Google Chrome to version 156.0.8078.47 or later, where this specific memory corruption issue has been resolved by developers through improved input validation and safer memory management practices in the XML parser. Organizations should enforce automated update policies for all endpoints running Chromium-based browsers to ensure timely patching of such high-severity vulnerabilities. Additionally, security teams can implement browser hardening techniques such as disabling unnecessary plugins or scripts that might interact with complex document object models. Network-level defenses like web application firewalls and intrusion detection systems may also help in identifying and blocking traffic containing known malicious payloads associated with this exploit chain before it reaches the client machine.