CVE-2026-113325 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2023-5929 represents a critical memory corruption flaw within the SignIn component of Google Chrome for iOS, specifically affecting versions prior to 156.0.8078.47. This defect is classified under CWE-122, which denotes heap-based buffer overflow, indicating that the application failed to properly validate boundaries when handling data structures associated with user authentication processes. The root cause lies in improper memory management practices where input derived from external sources was not sufficiently sanitized or bounds-checked before being written into allocated memory regions. This oversight allows for an out-of-bounds write operation, which can corrupt adjacent memory blocks and alter the state of critical security mechanisms within the browser environment.
From a technical perspective, this vulnerability is exploitable through social engineering tactics where a remote attacker crafts a malicious HTML page designed to trigger specific rendering or authentication flows within Chrome on iOS. When an unsuspecting user visits this crafted webpage, the embedded code interacts with the SignIn module in a way that triggers the memory corruption flaw. Because the attack vector involves web content execution, it aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter via Web Shell or similar browser-based exploitation methods. The attacker leverages the browser's own processing capabilities to execute arbitrary logic within the context of the vulnerable component, bypassing standard security controls that would otherwise prevent direct system-level access.
The operational impact of this vulnerability is significant due to its potential for information disclosure and privilege escalation within the sandboxed environment. By exploiting the heap-based buffer overflow, a remote attacker can potentially read memory contents inside the Chrome sandbox. This capability allows for the extraction of sensitive data such as session tokens, cookies, or other authentication credentials stored in memory during the sign-in process. Although iOS employs strict sandboxing to isolate applications and limit cross-process communication, successful exploitation of this flaw could allow an attacker to bypass these isolation boundaries by manipulating memory structures that control access permissions. This leads to CWE-200, Information Exposure, where confidential data becomes accessible to unauthorized entities without requiring physical device access or prior authentication credentials beyond the initial visit to the malicious site.
Mitigation strategies for this vulnerability primarily involve immediate software updates and rigorous patch management protocols. Users must upgrade Google Chrome on iOS to version 156.0.8078.47 or later, where these memory safety issues have been addressed through improved input validation and stricter boundary checks within the SignIn module. For enterprise environments, it is advisable to enforce automatic update policies for browser applications deployed across organizational devices to ensure that known vulnerabilities are patched promptly. Additionally, security awareness training should be conducted to educate users about the risks of visiting untrusted websites or clicking on suspicious links, as this remains the primary attack vector for exploiting such client-side memory corruption flaws. Implementing content security policies and restricting script execution in high-risk contexts can also provide an additional layer of defense against similar exploitation attempts.