CVE-2026-113040: Google Chrome Proxy RCE Vulnerability

CVE-2026-113040 Overview

CVE-2026-113040 is an improper input validation vulnerability [CWE-20] in the Proxy component of Google Chrome. The flaw affects Chrome versions prior to 156.0.8078.47 on desktop platforms. A remote attacker can exploit the issue by serving a crafted HTML page to a target user. Successful exploitation allows arbitrary code execution inside the Chrome sandbox. Google tracks the issue under Chromium Issue #568906040 and rates its security severity as High.

Critical Impact

Remote attackers can achieve arbitrary code execution inside the Chrome sandbox when a user visits a malicious web page, providing a foothold for sandbox escape chains.

Affected Products

• Google Chrome Desktop (Windows, macOS, Linux) prior to 156.0.8078.47
• Chromium-based browsers inheriting the vulnerable Proxy component
• Embedded applications bundling pre-156 Chromium builds

Discovery Timeline

• 2026-10-20 - CVE-2026-113040 published to the National Vulnerability Database
• 2026-10-22 - Record last modified in NVD

Technical Details for CVE-2026-113040

Vulnerability Analysis

The vulnerability resides in Chrome's Proxy handling logic. Chrome fails to properly validate input processed by the Proxy component, allowing a crafted web page to drive the code into an unexpected state. The resulting condition enables arbitrary code execution within the renderer sandbox. While sandboxed execution limits direct host compromise, it is routinely chained with sandbox escape vulnerabilities to achieve full system access. Successful exploitation requires only that a target user load attacker-controlled HTML content.

Root Cause

The defect is categorized as Improper Input Validation [CWE-20] in the Proxy component. Chrome does not sufficiently constrain or sanitize data flowing into Proxy-related code paths. This gap allows attacker-controlled values to influence execution flow in ways the component was not designed to handle. Google has not publicly released the technical specifics in the Chromium issue tracker entry #568906040, which remains restricted pending broader patch adoption.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts a crafted HTML page on an attacker-controlled site or injects malicious content into a trusted site through advertising or compromise. When a victim visits the page using a vulnerable Chrome build, the Proxy component processes attacker-controlled input and executes arbitrary code inside the sandbox. Common delivery mechanisms include phishing links, malvertising, and watering hole campaigns targeting high-value user populations.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in prose because no verified exploit code has been published. See the Chromium Issue Tracker ID #568906040 for the upstream reference.

Detection Methods for CVE-2026-113040

Indicators of Compromise

• Unexpected Chrome renderer or utility process crashes referencing the Proxy component.
• Outbound connections from Chrome child processes to previously unseen domains following a browsing session.
• Chrome spawning atypical child processes such as command shells or scripting interpreters.
• Modifications to proxy configuration files or system network settings without a corresponding administrative action.

Detection Strategies

• Inventory installed Chrome versions across endpoints and flag any build older than 156.0.8078.47.
• Monitor browser process trees for anomalous parent-child relationships indicative of post-exploitation activity.
• Correlate browser crash telemetry with recent URL visits to surface attempted exploitation attempts.
• Enable Chrome's enterprise reporting to capture extension changes and policy-relevant security events.

Monitoring Recommendations

• Collect endpoint process creation and network connection events into a central analytics platform for retrospective hunting.
• Alert on Chrome processes writing to persistence locations such as scheduled tasks, startup folders, or launch agents.
• Track DNS queries from Chrome processes against threat intelligence feeds covering recent malvertising infrastructure.

How to Mitigate CVE-2026-113040

Immediate Actions Required

• Update Google Chrome to 156.0.8078.47 or later on all Windows, macOS, and Linux endpoints.
• Restart browser sessions after the update completes so the patched binaries are loaded into memory.
• Audit Chromium-based browsers and embedded webviews for the vulnerable version range and apply vendor updates.
• Communicate the risk to end users and prioritize patching of high-value accounts such as administrators and developers.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fixed version is 156.0.8078.47. Enterprise administrators should push the update through managed deployment tooling and verify compliance using Chrome Browser Cloud Management or equivalent inventory systems.

Workarounds

• No vendor-provided workaround exists; applying the official patch is the only supported remediation.
• Reduce exposure in the interim by restricting browsing on unpatched systems and enforcing enterprise policies that block execution of unknown extensions.
• Deploy web filtering to block known malicious domains and limit exposure to malvertising networks until patching completes.

# Verify installed Chrome version on Linux
google-chrome --version

# Force Chrome update check on Windows via policy registry key
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f

# macOS: trigger Google Software Update
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot