CVE-2026-113291 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2023-XXXX, affecting Google Chrome prior to version 156.0.8078.47, represents a critical memory corruption flaw located within the FullScreen API implementation of the Blink rendering engine. This defect arises from improper handling of memory allocation and deallocation during state transitions when an element enters or exits full-screen mode. Specifically, the issue stems from a use-after-free condition where references to DOM elements are retained in internal data structures even after those objects have been destroyed due to garbage collection or explicit removal from the document tree. When the browser attempts to process subsequent events related to fullscreen changes, it accesses memory that has already been freed and potentially reallocated for other purposes. This scenario allows a remote attacker who controls the content of a webpage to manipulate these dangling pointers, leading to arbitrary read and write operations within the renderer process memory space.
From a technical perspective, this vulnerability is classified under CWE-416, Use After Free, which describes situations where software continues to use a pointer after it has been freed, typically leading to unstable behavior or execution of arbitrary code. The attack vector involves crafting an HTML page that triggers specific fullscreen state changes while simultaneously manipulating the underlying DOM structure to exploit the timing window between object destruction and reference cleanup. Although Google Chrome employs robust sandboxing mechanisms designed to isolate renderer processes from the host operating system, memory corruption vulnerabilities like this one can potentially be leveraged to escape these boundaries if combined with other exploitation techniques or if specific browser configurations are present. The Chromium security team has categorized this issue as Low severity, indicating that while it poses a risk of arbitrary code execution within the sandboxed environment, successful exploitation may require significant effort or additional conditions beyond simple remote access via a crafted webpage.
The operational impact of this vulnerability is primarily centered on the potential for unauthorized code execution within the context of the browser's renderer process. If an attacker successfully exploits this flaw, they could execute arbitrary commands with the privileges granted to the Chrome sandboxed process. While modern browsers isolate these processes from critical system resources, a successful exploit could still lead to data exfiltration, such as stealing cookies or session tokens stored in memory, or serve as a stepping stone for further attacks against other browser components if additional vulnerabilities are present. The risk is heightened when users visit maliciously crafted sites that automatically trigger fullscreen modes through JavaScript events, potentially bypassing user interaction prompts that might otherwise alert them to the suspicious activity.
Mitigation strategies focus on both immediate patching and long-term defensive coding practices. Users should immediately update Google Chrome to version 156.0.8078.47 or later, where this memory management issue has been resolved by ensuring proper reference counting and nullifying pointers after object destruction. For developers integrating fullscreen APIs into web applications, it is crucial to implement rigorous lifecycle management for DOM elements involved in fullscreen transitions. This includes verifying the validity of element references before accessing properties related to screen state changes. Additionally, enabling browser security features such as Site Isolation can help mitigate the impact by restricting how renderer processes share memory with other sites, thereby reducing the attack surface available to an attacker attempting to leverage this vulnerability for cross-site attacks or sandbox escapes.
This incident underscores the importance of continuous integration testing and static analysis tools that detect use-after-free patterns in complex JavaScript engines like V8. Industry standards such as OWASP Web Security Testing Guide recommend rigorous dynamic analysis during development phases to catch these types of memory safety issues before deployment. Furthermore, adherence to secure coding guidelines that emphasize explicit resource management and the avoidance of raw pointer manipulation where possible can significantly reduce the likelihood of similar vulnerabilities in future releases. By maintaining up-to-date software versions and employing robust security practices, organizations and individuals can effectively neutralize the threat posed by this specific memory corruption flaw in Google Chrome.