CVE-2026-119272 in Chrome
Summary
by MITRE • 10/30/2026
Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified as an out-of-bounds read within the FileSystem component of Google Chrome prior to version 156.0.8078.79 represents a critical memory safety flaw that undermines the browser's sandboxing mechanisms. This type of error typically occurs when software attempts to access data at a memory location beyond the intended boundaries, often due to improper validation of input parameters or incorrect calculation of array indices and buffer sizes. In the context of web browsers, such flaws are particularly dangerous because they can be triggered by maliciously crafted content delivered over the internet, allowing attackers to exploit the vulnerability without any user interaction other than visiting a compromised website.
From a technical perspective, this out-of-bounds read allows an attacker to leak sensitive information from the browser's memory space. While Chrome employs robust sandboxing techniques designed to isolate different processes and limit the impact of exploits, certain components like FileSystem may operate with elevated privileges or access critical internal data structures. By exploiting this flaw through a crafted HTML page, a remote attacker can cause the application to read arbitrary memory locations that should remain inaccessible. This capability effectively bypasses some layers of defense-in-depth, enabling the extraction of potentially sensitive data such as cookies, session tokens, passwords stored in memory, or other proprietary information held by the browser during normal operation.
The operational impact of this vulnerability is significant due to its potential for remote code execution precursors and privacy violations. Although classified with a medium severity rating within Chromium's internal framework, the ability to read arbitrary memory can serve as a stepping stone for more severe attacks. Attackers may use leaked information to perform session hijacking, identity theft, or further reconnaissance against targeted systems. Furthermore, in some scenarios, out-of-bounds reads can lead to crashes that disrupt service availability or provide clues about memory layout that facilitate subsequent exploitation attempts aimed at achieving arbitrary code execution within the sandboxed environment.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-Bounds Read vulnerabilities where a read operation is performed with an index pointer that references a memory location prior to the beginning of the intended buffer. It also relates to ATT&CK technique T1005, Data from Local System, as it involves exfiltrating data directly from the victim's machine through browser-based exploitation vectors. The attack vector corresponds to remote code execution prerequisites often seen in web application attacks where untrusted input is not sufficiently sanitized before being processed by low-level system components.
To mitigate this risk, users must ensure that Google Chrome is updated to version 156.0.8078.79 or later immediately upon availability. Automatic update settings should be verified and enabled to prevent future exposure to similar vulnerabilities as they are discovered and patched. For organizations managing large deployments of browsers, centralized patch management systems should be utilized to enforce timely updates across all endpoints. Additionally, security teams should monitor for indicators of compromise related to memory scraping techniques or unusual network traffic patterns that might indicate exploitation attempts targeting older browser versions lacking these critical fixes.