CVE-2026-113286 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified involves a memory corruption flaw within the Google Lens component integrated into versions of Google Chrome prior to 156.0.8078.47. This defect represents a critical failure in how the browser handles specific data structures during the rendering and processing of web content, specifically when interacting with features related to visual search and image recognition capabilities embedded within the Chromium engine. The root cause lies in improper memory management practices where allocated buffers are not correctly validated or bounds-checked before being accessed by the Lens subsystem. This oversight allows for conditions such as heap buffer overflows or use-after-free scenarios, which compromise the integrity of the process memory space. Although classified with a low severity rating within the Chromium security framework due to mitigating factors like sandboxing and exploit complexity, the underlying technical flaw remains significant because it directly targets the execution flow of privileged browser processes.
From an operational perspective, this vulnerability enables a remote attacker to achieve arbitrary code execution inside the Chrome sandbox by crafting a malicious HTML page that triggers the flawed memory handling routine during image processing or lens feature activation. The attack vector relies on social engineering or drive-by download tactics where a victim is induced to visit a specially constructed webpage containing exploit code designed to manipulate the Lens component's internal state. By carefully controlling heap layout and triggering specific rendering paths, an attacker can overwrite critical pointers or return addresses within the sandboxed process memory. This manipulation allows for the execution of arbitrary shellcode with the privileges granted to that specific browser subprocess. While the sandbox architecture is designed to limit the impact of such breaches by restricting access to system resources, successful exploitation could still lead to data exfiltration from the current tab context or serve as a stepping stone for further privilege escalation if additional vulnerabilities are chained together within the same session.
The technical classification of this issue aligns with CWE-120 Buffer Copy without Checking Size of Input and potentially CWE-416 Use After Free, depending on the specific memory state manipulation involved in the exploit chain. In terms of adversary behavior mapping to MITRE ATT&CK techniques, this vulnerability facilitates T1203 Exploitation for Client Execution, as it allows code execution triggered by user interaction with a web page. It also relates to T1059 Command and Scripting Interpreter if the executed payload involves scripting languages within the browser environment. The low severity rating in Chromium likely reflects the difficulty of reliably exploiting this specific memory corruption state across different platforms or versions without crashing the renderer process, which would terminate the attack before full code execution could be achieved. However, the potential for reliable exploitation remains a serious concern given the widespread adoption of Google Chrome and its integrated AI-driven features like Lens.
Mitigation strategies primarily involve immediate patching to version 156.0.8078.47 or later where these memory management checks have been reinforced by Chromium developers. Security teams should ensure that automatic update mechanisms are enabled for all endpoints running affected browser versions to minimize the window of exposure. Additionally, organizations can employ application whitelisting and strict Content Security Policy configurations to restrict the execution of untrusted scripts within the browser environment. Network-level controls such as web filtering proxies can be configured to block access to known malicious domains hosting exploit kits that target this specific vulnerability. For users who cannot immediately update, disabling unnecessary features like Google Lens or restricting permissions for image-heavy websites may reduce the attack surface, although complete mitigation requires updating the binary itself to address the fundamental memory safety violations in the source code.