CVE-2026-113317 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability described involves a critical memory corruption flaw within the Accessibility subsystem of Google Chrome on macOS, specifically affecting versions prior to 156.0.8078.47. This defect represents a significant breach in the browser's internal data handling mechanisms, where improper validation or bounds checking allows for unauthorized manipulation of memory structures. The root cause typically stems from issues such as use-after-free conditions, buffer overflows, or type confusion errors within the code responsible for processing accessibility tree updates and interactions. These types of flaws are particularly dangerous because they occur in a subsystem that is frequently accessed by web pages to provide assistive technologies with information about page structure and state, thereby increasing the attack surface available to malicious actors.
From an operational perspective, this vulnerability allows a remote attacker to potentially execute arbitrary code within the browser's sandbox environment. The accessibility feature is integral to how browsers interact with operating system-level screen readers and other assistive tools, meaning that web pages can trigger complex internal operations when interacting with dynamic content or ARIA attributes. By crafting a specific HTML page containing malicious scripts designed to exploit this memory corruption flaw, an attacker can corrupt the browser's heap or stack memory in a controlled manner. This control enables the manipulation of function pointers or object references, leading to arbitrary code execution despite the presence of sandboxing protections that are normally effective against less sophisticated attacks.
The security severity is classified as High by Chromium standards due to the potential for remote code execution (RCE). While modern browsers employ multiple layers of defense such as ASLR, DEP, and strict sandbox isolation, memory corruption vulnerabilities often provide the necessary primitives to bypass these mitigations through techniques like heap spraying orROP chains. If successfully exploited, this vulnerability could allow an attacker to escape the browser's restricted environment, potentially gaining access to sensitive user data, installing malware, or using the compromised machine as part of a botnet. The impact is compounded by the fact that accessibility features are often enabled by default on many systems, making users more susceptible if they visit malicious sites while relying on these tools.
In terms of industry classification frameworks, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-416 Use After Free, which are common sources of memory corruption in C++ based applications like Chrome. Furthermore, the exploitation technique falls under MITRE ATT&CK tactic T1203 Exploitation for Client Execution, specifically targeting client software through web-based delivery mechanisms such as crafted HTML pages hosted on malicious websites or compromised advertising networks. The attack vector is classified as Network with High complexity requirements regarding user interaction if it requires clicking a link, but potentially Low complexity if delivered via drive-by download techniques leveraging the accessibility API triggers.
To mitigate this risk, users must ensure that Google Chrome is updated to version 156.0.8078.47 or later on macOS systems. This update contains patches for the underlying memory management issues within the Accessibility component. Organizations should enforce automated patching policies to minimize the window of exposure. Additionally, security teams can monitor network traffic for unusual outbound connections from browser processes following visits to untrusted sites, as this may indicate a successful exploitation attempt. Enabling Google Chrome's built-in sandbox and ensuring that hardware-based virtualization features are active on the host system provides an additional layer of defense against potential code execution attempts stemming from such vulnerabilities.