CVE-2026-113011: Google Chrome Use-After-Free Vulnerability

CVE-2026-113011 Overview

CVE-2026-113011 is a use-after-free vulnerability in the CredentialProvider component of Google Chrome on Windows. The flaw affects Chrome versions prior to 156.0.8078.47 and allows a remote attacker to execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page. The National Vulnerability Database rates the issue 8.8 (HIGH), while Chromium classifies the security severity as Medium. User interaction is required, as the victim must visit an attacker-controlled page. The flaw is tracked under CWE-416: Use After Free.

Critical Impact
Successful exploitation lets a remote attacker run arbitrary code within the Chrome renderer sandbox on Windows via a single malicious web page visit.

Affected Products

Google Chrome on Windows prior to 156.0.8078.47
Microsoft Windows platforms running vulnerable Chrome builds
Chromium-based downstream browsers that inherit the CredentialProvider code path

Discovery Timeline

2026-10-20 - CVE-2026-113011 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113011

Vulnerability Analysis

The vulnerability resides in Chrome's CredentialProvider, a Windows-integration component that brokers credential operations between the browser and the operating system. A use-after-free condition occurs when the component continues to reference a heap object after it has been freed. An attacker who controls allocation and reuse of that memory region can place controlled data where the freed object once lived. The dangling reference then operates on attacker-shaped memory, enabling control over function pointers or object virtual tables.

Because the sink is reachable from untrusted web content, a crafted HTML page is sufficient to drive the flow. Exploitation yields code execution inside the Chrome sandboxed renderer process. The attacker must still chain a separate sandbox escape to reach the host operating system.

Root Cause

The root cause is improper object lifetime management in CredentialProvider [CWE-416]. A reference to a heap-allocated object persists past its deallocation, and a subsequent operation dereferences the stale pointer without validating the object state.

Attack Vector

Exploitation is remote and requires user interaction. A victim visits an attacker-controlled site that serves JavaScript and DOM content designed to trigger the vulnerable allocation sequence, free the target object, groom the heap, and reuse the freed slot. See the Chromium Issue Tracker #498843754 and the Google Chrome Desktop Update advisory for release details.

No public proof-of-concept or exploit is available at publication time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-113011

Indicators of Compromise

Unexpected child processes spawned from chrome.exe, particularly shells or script interpreters such as cmd.exe, powershell.exe, or wscript.exe.
Chrome renderer process crashes with access-violation exceptions correlated with recent navigation to untrusted sites.
Outbound connections from Chrome renderer processes to low-reputation domains following a page visit.

Detection Strategies

Inventory installed Chrome builds across Windows endpoints and alert on versions earlier than 156.0.8078.47.
Monitor Windows Error Reporting (WER) and crash dumps for CredentialProvider call stacks within Chrome processes.
Correlate browser telemetry with endpoint EDR events to flag post-navigation process injection or anomalous memory allocations.

Monitoring Recommendations

Collect browser version and extension telemetry centrally to identify unpatched hosts.
Enable Windows event forwarding for process-creation events (Event ID 4688) with parent process context to catch sandbox-adjacent abuse.
Baseline normal child-process behavior for chrome.exe and alert on deviations.

How to Mitigate CVE-2026-113011

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on every Windows endpoint.
Restart Chrome after update to ensure the patched binary is loaded in memory.
Validate downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates as they ship the Chromium fix.

Patch Information

Google released the fix in the Chrome Stable channel at version 156.0.8078.47. Refer to the Google Chrome Desktop Update advisory for the full release notes and the Chromium Issue Tracker #498843754 for issue metadata.

Workarounds

Enforce Chrome auto-update through enterprise policy to minimize patch latency.
Restrict browsing to trusted sites via group policy or secure web gateways until all endpoints are patched.
Deploy site isolation and strict HTTPS enforcement to reduce the attack surface for crafted-page delivery.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" /v DisplayVersion

# Force update check via Google Update
"%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler