CVE-2026-113044: Google Chrome V8 Use After Free Vulnerability

CVE-2026-113044 is a use after free vulnerability in Google Chrome's V8 JavaScript engine that allows remote attackers to execute arbitrary code within the sandbox via crafted HTML pages. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2026-113044 Overview

CVE-2026-113044 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a target user. The flaw affects Google Chrome versions prior to 156.0.8078.47 and is tracked under CWE-416. Google rates the Chromium security severity as High. Exploitation requires user interaction, specifically visiting an attacker-controlled page. The issue was addressed in the Chrome Stable channel desktop update published by Google.

Critical Impact
Remote arbitrary code execution within the Chrome renderer sandbox following a single visit to a malicious web page.

Affected Products

Google Chrome Desktop prior to 156.0.8078.47
Chromium-based builds that embed vulnerable V8 engine versions
All supported desktop operating systems running the affected Chrome builds

Discovery Timeline

2026-10-20 - CVE-2026-113044 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113044

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine shipped with Chrome. V8 compiles and executes untrusted JavaScript from any page the browser loads. A use-after-free condition in V8 lets attacker-controlled JavaScript reference heap memory that has already been released. Reusing freed memory allows the attacker to corrupt internal engine state and redirect execution. Successful exploitation yields arbitrary code execution within the renderer process, which runs inside the Chromium sandbox. Attackers typically chain a renderer bug such as this one with a separate sandbox escape to reach the host operating system. Additional technical context is available in the Chromium Issue Tracker Entry.

Root Cause

The root cause is a use-after-free defect [CWE-416] in V8 object lifetime management. Specific object references persist after the backing allocation is freed, so a later operation dereferences stale memory. Attackers shape the heap with JavaScript to place controlled data where the engine expects a valid object.

Attack Vector

Exploitation requires a user to load attacker-controlled HTML containing crafted JavaScript. The attack is network-based and does not require prior authentication. Common delivery vectors include phishing links, malicious advertisements, and compromised legitimate sites. No synthetic proof-of-concept code is published in this advisory; refer to the Chrome Desktop Update Announcement for vendor details.

// No verified public proof-of-concept available at time of writing.
// See the Chromium Issue Tracker for technical details once the bug is unrestricted.

Detection Methods for CVE-2026-113044

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
Outbound connections from chrome.exe to newly registered or low-reputation domains immediately after page loads
Browser crash dumps referencing V8 modules shortly before suspicious process activity

Detection Strategies

Inventory installed Chrome versions across the fleet and flag builds older than 156.0.8078.47
Alert on anomalous process lineage where Chrome renderer sandbox processes write executables or load unsigned modules
Correlate web proxy logs for user visits to suspicious domains with subsequent endpoint behavioral alerts

Monitoring Recommendations

Centralize browser version telemetry and patch compliance reporting through endpoint management tooling
Monitor EDR telemetry for post-exploitation behaviors such as credential access, discovery commands, and persistence attempts originating from Chrome
Track Google's Chrome Releases blog and ingest advisories into vulnerability management workflows

How to Mitigate CVE-2026-113044

Immediate Actions Required

Update Google Chrome Desktop to version 156.0.8078.47 or later on all managed endpoints
Restart browsers after update deployment to ensure the patched binary is active
Audit Chromium-based applications and embedded browsers for upstream V8 patch inclusion

Patch Information

Google addressed CVE-2026-113044 in the Chrome Stable channel update documented in the Chrome Desktop Update Announcement. Enterprises using managed Chrome deployments should force policy-based updates through group policy or MDM. Chromium downstream projects should rebase to the fixed V8 revision referenced in the Chromium Issue Tracker Entry.

Workarounds

Restrict JavaScript execution on untrusted sites using Chrome enterprise policies where feasible
Deploy site isolation and strict content filtering through secure web gateways to reduce exposure to malicious pages
Train users to avoid unsolicited links and enable automatic browser updates on unmanaged devices

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Example Windows registry check for enterprise-managed Chrome version
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv