CVE-2026-113299 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within Google Chrome versions preceding 156.0.8078.47 represents a critical memory corruption flaw located in the WebProtect component of the Chromium engine. This specific subsystem is responsible for enforcing safety features and filtering mechanisms designed to protect users from malicious content encountered during web browsing operations. The nature of this vulnerability allows a remote attacker, through the delivery of a specially crafted HTML page, to trigger an exploitable condition that compromises the integrity of memory structures managed by the browser process. Although classified with a low severity rating within the Chromium security framework due to mitigating factors such as sandboxing and other defense-in-depth mechanisms, the underlying technical flaw remains significant because it involves arbitrary code execution potential within a privileged context relative to standard web content restrictions.
From a technical perspective, memory corruption vulnerabilities typically arise from improper handling of data structures in native code components like those found in C++ based browsers. In this instance, the WebProtect module likely failed to properly validate input or manage buffer boundaries when processing specific elements within the crafted HTML payload. This failure results in conditions such as heap overflow, use-after-free, or type confusion, which allow an attacker to overwrite adjacent memory locations with controlled data. By carefully crafting the malicious webpage, an adversary can manipulate these corrupted memory states to redirect execution flow toward shellcode injected into the process space. The ultimate goal is to bypass the browser's sandboxing architecture and achieve arbitrary code execution on the victim's system, effectively escalating privileges from a restricted web context to full control over the application environment.
The operational impact of this vulnerability centers on the potential for remote code execution without user interaction beyond visiting the malicious site or having it auto-load via redirects. While Chrome’s multi-process architecture isolates renderer processes and limits their access to sensitive system resources, successful exploitation could still lead to data exfiltration, installation of persistent malware, or further lateral movement within a network if additional vulnerabilities are chained together. The low severity designation suggests that exploitability may be difficult in practice due to modern browser mitigations such as Control Flow Integrity (CFI), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR). However, these protections do not eliminate the risk entirely, particularly for targeted attacks where attackers possess detailed knowledge of specific memory layouts or can bypass certain checks through sophisticated techniques.
This incident aligns with Common Weakness Enumeration category CWE-120, which covers buffer copy without checking size limits, and potentially CWE-416 regarding use-after-free conditions if the corruption stems from dangling pointer dereferences. In terms of adversary tactics, this vulnerability maps to MITRE ATT&CK technique T1203, specifically the exploitation for client-side execution phase, where attackers leverage software vulnerabilities in applications running on target systems. The attack vector is classified as remote with low complexity requirements regarding user interaction if auto-execution features are enabled or social engineering is employed to trigger page loads automatically.
To mitigate this risk, organizations and individual users must ensure that Google Chrome is updated immediately to version 156.0.8078.47 or later, where the underlying memory management logic in WebProtect has been corrected. Administrators should enforce automatic update policies across all endpoints to minimize exposure windows. Additionally, security teams should monitor for indicators of compromise associated with exploit kits that target browser vulnerabilities and consider deploying endpoint detection and response solutions capable of identifying anomalous process behavior indicative of sandbox escapes or arbitrary code execution attempts. Regular patch management remains the most effective defense against such memory corruption flaws until more robust architectural changes are implemented in future releases.