CVE-2026-113024: Google Chrome Use-After-Free Vulnerability

CVE-2026-113024 Overview

CVE-2026-113024 is a use-after-free vulnerability in the WebAppInstalls component of Google Chrome prior to version 156.0.8078.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw is tracked under CWE-416 and requires user interaction to trigger. Google classified the Chromium security severity as Low, but the CVSS v3.1 base score reflects a higher impact on confidentiality, integrity, and availability within the renderer process.

Critical Impact
Attackers can execute arbitrary code inside the Chrome sandbox through a crafted HTML page, providing a foothold for sandbox escape chains.

Affected Products

Google Chrome versions prior to 156.0.8078.47 (Desktop Stable channel)
Chromium-based builds incorporating the vulnerable WebAppInstalls component
Downstream browsers that embed the affected Chromium release

Discovery Timeline

2026-10-20 - CVE-2026-113024 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113024

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls subsystem, which handles Progressive Web App (PWA) installation flows in Chrome. A use-after-free condition occurs when an object managed by the installation pipeline is freed while a reference to it remains reachable. Subsequent operations dereference the dangling pointer, enabling an attacker to influence memory contents that are later used as a valid object. Successful exploitation yields arbitrary code execution inside the renderer sandbox.

Exploitation requires a victim to load a crafted HTML page that drives the WebAppInstalls logic into the vulnerable state. Because the attack vector is network-based and no privileges are required, drive-by exploitation through malicious or compromised sites is viable.

Root Cause

The root cause is improper object lifetime management [CWE-416] within the WebAppInstalls component. An object is released while asynchronous callbacks or event handlers still hold references to it. When those references are later dereferenced, the freed memory may have been reused by attacker-controlled data, leading to type confusion and controlled flow redirection.

Attack Vector

The attacker hosts a crafted HTML page that invokes PWA installation APIs in a sequence that triggers the premature free. The victim must visit the page or be redirected to it. Once the dangling pointer is dereferenced, the attacker gains code execution within the renderer sandbox. Full compromise typically requires chaining this flaw with a separate sandbox escape.

Technical details are tracked in Chromium Issue Tracker #533043403.

Detection Methods for CVE-2026-113024

Indicators of Compromise

Chrome renderer process crashes with signatures referencing WebAppInstalls or PWA installation code paths.
Unexpected child processes spawned from chrome.exe immediately after visiting an untrusted site.
Outbound connections from renderer processes to uncategorized or newly registered domains hosting PWA manifests.

Detection Strategies

Inventory browser versions across the fleet and flag Chrome installations below 156.0.8078.47.
Monitor endpoint telemetry for anomalous memory access violations originating in Chrome renderer processes.
Correlate web proxy logs with Chrome crash reports to identify URLs preceding renderer faults.

Monitoring Recommendations

Enable Chrome crash reporting and forward reports to a centralized analysis pipeline.
Alert on process injection or sandbox escape behaviors following Chrome renderer anomalies.
Track EPSS trends and public exploit disclosures for CVE-2026-113024 to adjust response posture.

How to Mitigate CVE-2026-113024

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all Windows, macOS, and Linux endpoints.
Restart browsers after update deployment to ensure the patched binary is loaded.
Audit Chromium-based applications and extensions for embedded vulnerable builds.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update. Administrators should push the update through enterprise management tooling and verify version compliance via chrome://version.

Workarounds

Restrict PWA installation through enterprise policy using the WebAppInstallForceList and related install controls where feasible.
Enforce strict web filtering to block access to untrusted sites until patching is complete.
Deploy site isolation and ensure renderer sandboxing is active to limit post-exploitation impact.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Example enterprise policy snippet (JSON) to restrict web app installs
# Place in Chrome managed policy directory
{
  "WebAppInstallForceList": [],
  "DefaultWebUsbGuardSetting": 2
}