CVE-2026-113023: Google Chrome Extensions RCE Vulnerability

CVE-2026-113023 Overview

CVE-2026-113023 is an improper input validation flaw [CWE-20] in the Extensions component of Google Chrome. Versions prior to 156.0.8078.47 are affected. A remote attacker can leverage a crafted HTML page to execute arbitrary code outside the Chrome sandbox. Exploitation requires user interaction, such as visiting a malicious page. Google tracked the issue as Chromium Issue #517148875 and shipped a fix in the stable desktop channel.

Critical Impact

Successful exploitation lets a remote attacker break out of the Chrome renderer sandbox and run arbitrary code on the host with the privileges of the browser process.

Affected Products

• Google Chrome Desktop versions prior to 156.0.8078.47
• Chromium-based builds that embed the vulnerable Extensions component
• All supported desktop operating systems (Windows, macOS, Linux)

Discovery Timeline

• 2026-10-20 - CVE-2026-113023 published to the National Vulnerability Database
• 2026-10-21 - Entry last modified in the NVD database

Technical Details for CVE-2026-113023

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions subsystem, which brokers privileged APIs between untrusted web content and the browser process. Improper input validation [CWE-20] allows attacker-controlled values from a crafted HTML page to flow into extension-handling code paths that assume well-formed input. When exploited, the flaw permits code execution outside the renderer sandbox, giving the attacker the privileges of the browser process rather than a confined child process. Although Chromium rates the underlying bug as Low severity, the chained outcome — sandbox escape via a web page — produces a high-impact scenario across confidentiality, integrity, and availability.

Root Cause

The root cause is insufficient validation of input values processed by the Extensions component. The component accepts data derived from untrusted web content without enforcing strict type, length, or structural constraints before passing it to higher-privilege code paths.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a victim to visit it in a vulnerable Chrome build. The page triggers the flawed code path in Extensions, pivots out of the sandbox, and executes arbitrary code on the client. No prior authentication to the target system is required.

No verified public proof-of-concept code is available for CVE-2026-113023. Technical details are tracked in the Chromium Issue Tracker #517148875.

Detection Methods for CVE-2026-113023

Indicators of Compromise

• Chrome renderer or utility processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters.
• Browser processes writing executable content to user-writable directories like %APPDATA%, %TEMP%, or ~/Library/Application Support/.
• Outbound connections from chrome.exe to unfamiliar domains shortly after a user visits an untrusted page.

Detection Strategies

• Inventory installed Chrome builds and alert on versions earlier than 156.0.8078.47.
• Baseline normal Chrome process trees and flag deviations such as browser-spawned script interpreters or LOLBins.
• Monitor for anomalous extension installations, updates, or permission changes initiated outside the Chrome Web Store flow.

Monitoring Recommendations

• Collect endpoint process creation, file write, and network telemetry for all browser processes and forward to a centralized analytics platform.
• Correlate web proxy or DNS logs with endpoint events to identify victims who visited suspicious pages before anomalous Chrome activity.
• Track Chrome version telemetry across the fleet to confirm patch adoption and surface stragglers.

How to Mitigate CVE-2026-113023

Immediate Actions Required

• Update Google Chrome to version 156.0.8078.47 or later on all desktop endpoints.
• Restart Chrome after the update to ensure the patched binaries are loaded.
• Audit managed extension inventories and remove unused or untrusted extensions to shrink the attack surface.

Patch Information

Google shipped the fix in the stable desktop channel. Review the Google Chrome Desktop Update advisory for release notes and distribution details. Enterprise deployments should push the update through existing software management tooling and verify version 156.0.8078.47 or higher is active.

Workarounds

• Enforce Chrome auto-update via enterprise policy so patched builds roll out without user action.
• Restrict extension installation to an administrator-approved allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies.
• Apply web filtering to block known malicious domains and reduce the chance of users loading crafted HTML pages.

# Example Chrome enterprise policy to restrict extensions (Linux policy JSON)
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved_extension_id_1>",
    "<approved_extension_id_2>"
  ],
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked"
    }
  }
}