CVE-2026-113041: Google Chrome Use After Free Vulnerability

CVE-2026-113041 Overview

CVE-2026-113041 is a use-after-free vulnerability in the Actor component of Google Chrome versions prior to 156.0.8078.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a target user. The flaw is tracked under CWE-416: Use After Free and requires user interaction, such as visiting an attacker-controlled website. Google rates the Chromium security severity as Medium, while the NVD assigns a CVSS 3.1 base score of 8.8 (High).

Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox, providing an attacker with a reliable foothold for further sandbox escape chains.

Affected Products

Google Chrome Desktop versions prior to 156.0.8078.47
Chromium-based browsers that incorporate the vulnerable Actor component
All supported desktop platforms (Windows, macOS, Linux) running the pre-patch Stable channel

Discovery Timeline

2026-10-20 - CVE-2026-113041 published to the National Vulnerability Database
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113041

Vulnerability Analysis

The vulnerability resides in Chrome's Actor component, which handles automated and scripted interactions within the browser. A use-after-free condition occurs when the component continues to reference heap memory after that memory has been released. An attacker who controls the timing of allocation and deallocation can place attacker-controlled data in the reclaimed memory region. When Chrome later dereferences the stale pointer, the attacker gains control over execution within the sandboxed renderer process.

The attack is delivered over the network through a crafted HTML page, requires no privileges, and relies on user interaction such as clicking a link or loading an iframe. Code execution is confined to the Chrome sandbox, so a full compromise typically requires chaining this bug with a separate sandbox escape primitive.

Root Cause

The root cause is improper object lifetime management in the Actor subsystem. A reference to a freed object is retained and later used, violating the invariant that pointers must not outlive the memory they reference. See the Chromium Issue Tracker #524319033 for upstream tracking of the fix.

Attack Vector

Exploitation requires a victim to load attacker-controlled HTML in a vulnerable version of Chrome. The crafted page triggers specific Actor operations that force the premature release of an object while leaving a dangling reference. The attacker then grooms the heap, reallocates the freed slot with controlled data, and triggers the dangling use to pivot execution. The vulnerability is reachable from any origin, including malvertising, phishing links, and compromised third-party scripts.

No public proof-of-concept exploit code is available in the referenced sources, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-113041

Indicators of Compromise

Chrome renderer processes (chrome.exe --type=renderer) crashing with access violation or SIGSEGV signatures shortly after page loads
Outbound connections from Chrome to newly registered or low-reputation domains serving JavaScript-heavy HTML payloads
Unexpected child processes spawned by chrome.exe on endpoints running versions earlier than 156.0.8078.47

Detection Strategies

Inventory browser builds across the fleet and flag any Chrome install older than 156.0.8078.47 as exposed
Hunt for renderer crash telemetry correlated with navigation events to external URLs within short time windows
Monitor for post-exploitation behaviors such as credential store access, token theft, or sandbox escape attempts initiated from a browser process

Monitoring Recommendations

Centralize browser version telemetry and crash dumps in your SIEM or data lake for cross-fleet correlation
Alert on anomalous process trees originating from chrome.exe, including shell interpreters or scripting hosts
Correlate web proxy logs with endpoint identification telemetry to identify users who visited suspicious URLs preceding renderer anomalies

How to Mitigate CVE-2026-113041

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Verify that managed Chrome deployments are not pinned to older channels or blocked from auto-update by group policy

Patch Information

Google addressed the vulnerability in the Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm rollout through enterprise update mechanisms such as Google Update, Microsoft Intune, or Jamf.

Workarounds

Enforce strict site isolation and keep the Chrome sandbox enabled; do not launch the browser with --no-sandbox
Restrict access to untrusted web content through enterprise web filtering and DNS reputation controls until patching is complete
Deploy browser management policies that enforce automatic updates and block execution of outdated Chrome binaries

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Example Windows registry policy to enforce automatic updates for Chrome
# HKLM\Software\Policies\Google\Update
#   UpdateDefault = 1 (Always allow updates)
#   AutoUpdateCheckPeriodMinutes = 60