CVE-2026-113042: Google Chrome Use After Free Vulnerability

CVE-2026-113042 Overview

CVE-2026-113042 is a use-after-free vulnerability [CWE-416] in the Extensions component of Google Chrome. The flaw affects Chrome versions prior to 156.0.8078.47. A remote attacker can exploit the issue by convincing a user to visit a crafted HTML page, resulting in arbitrary code execution inside the Chrome sandbox. Google classifies the Chromium security severity as Medium, while the National Vulnerability Database assigns a higher CVSS score reflecting network reach and impact to confidentiality, integrity, and availability.

Critical Impact
Successful exploitation grants arbitrary code execution within the Chrome renderer sandbox, providing attackers a foothold that can be chained with a sandbox escape to achieve full compromise.

Affected Products

Google Chrome versions prior to 156.0.8078.47 (Stable channel, Desktop)
Chromium-based browsers that incorporate the vulnerable Extensions code paths
Enterprise deployments of Chrome managed via Google Admin console

Discovery Timeline

2026-10-20 - CVE-2026-113042 published to the National Vulnerability Database
2026-10-22 - Last updated in the NVD database

Technical Details for CVE-2026-113042

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. A use-after-free condition occurs when the browser continues to reference an object in memory after that object has been freed. An attacker who triggers the free, then reclaims the memory with attacker-controlled data, can hijack control flow when the dangling pointer is dereferenced. Exploitation requires user interaction, typically loading a crafted HTML page. Successful exploitation yields arbitrary code execution inside the renderer sandbox, which attackers commonly pair with a separate sandbox-escape vulnerability to compromise the host.

Root Cause

The root cause is improper lifetime management of an object within Chrome's Extensions implementation. Chromium code must ensure references to extension-related objects are released or updated when the backing object is destroyed. When this invariant is violated, operations on the stale pointer read or write freed heap memory. See the Chromium Issue Tracker #517486906 for technical specifics once Google removes the view restriction.

Attack Vector

Exploitation is network-based and requires a victim to load attacker-controlled web content. The attacker hosts a malicious HTML page that interacts with the vulnerable Extensions code paths through JavaScript or extension APIs. No prior authentication is required. Because the issue affects the renderer-side Extensions component, exploitation delivers code execution within the sandboxed renderer process, not directly on the host operating system.

Detection Methods for CVE-2026-113042

Indicators of Compromise

Chrome renderer processes crashing with heap corruption or access-violation signatures shortly after visiting external web pages
Outbound connections from chrome.exe child processes to previously unseen or low-reputation domains serving HTML payloads
Unexpected installation, enablement, or modification of browser extensions following a browsing session
Child processes spawned by Chrome that are inconsistent with normal browsing behavior

Detection Strategies

Inventory Chrome versions across the fleet and alert on any instance below 156.0.8078.47
Correlate browser crash telemetry with URL navigation history to identify repeated crashes tied to specific external pages
Hunt for extension API abuse patterns in endpoint telemetry, including rapid install, update, or permission changes

Monitoring Recommendations

Forward Chrome crash dumps and chrome://crashes data to a central logging pipeline for triage
Monitor process-creation events where chrome.exe is the parent and investigate anomalous child binaries
Track outbound DNS and HTTP requests from browser processes using endpoint and network telemetry

How to Mitigate CVE-2026-113042

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update completes to ensure the patched binaries are loaded into running processes
Audit installed browser extensions and remove any that are unused, untrusted, or out of policy
Enforce automatic Chrome updates through group policy or mobile device management

Patch Information

Google addressed CVE-2026-113042 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should deploy 156.0.8078.47 or later across managed endpoints and verify version compliance after rollout.

Workarounds

Restrict installation of third-party extensions using the ExtensionInstallBlocklist and ExtensionInstallAllowlist enterprise policies
Limit exposure by browsing untrusted content from a dedicated, non-privileged profile until patches are deployed
Enable Enhanced Safe Browsing to increase coverage against malicious landing pages serving exploit payloads

bash

# Enterprise policy example: block all extensions except an approved allowlist
# Windows registry location: HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist

# Block all extensions
ExtensionInstallBlocklist\1 = "*"

# Allow only approved extension IDs
ExtensionInstallAllowlist\1 = "approved-extension-id-1"
ExtensionInstallAllowlist\2 = "approved-extension-id-2"

# Force minimum Chrome version at launch
BrowserSwitcherEnabled = 0