CVE-2026-113046: Google Chrome RCE Vulnerability

CVE-2026-113046 Overview

CVE-2026-113046 is an improper input validation vulnerability [CWE-20] in the Passwords component of Google Chrome. Versions prior to 156.0.8078.47 allow a remote attacker to execute arbitrary code inside the Chrome sandbox through a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious website.

The flaw affects the Chrome stable channel on desktop platforms. Google rated the Chromium security severity as Low, while the NVD CVSS v3.1 assessment scores the issue higher based on confidentiality, integrity, and availability impact.

Critical Impact
Arbitrary code execution inside the Chrome renderer sandbox via a crafted HTML page, enabling further exploitation chains when combined with a sandbox escape.

Affected Products

Google Chrome Desktop versions prior to 156.0.8078.47
Chromium-based builds that share the vulnerable Passwords component
Enterprise Chrome deployments on Windows, macOS, and Linux running pre-patch builds

Discovery Timeline

2026-10-20 - CVE-2026-113046 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113046

Vulnerability Analysis

The vulnerability resides in the Passwords component of Google Chrome. Improper input validation [CWE-20] allows a crafted HTML page to supply malformed data to code paths that handle password-related operations. The validation gap enables an attacker to drive execution into unintended states that lead to arbitrary code execution within the renderer sandbox.

Exploitation requires a user to load attacker-controlled content, aligning with the user-interaction requirement in the CVSS vector. Code executed through this bug is constrained by the Chrome sandbox. Chained with a separate sandbox escape, the attacker can reach broader privileges on the host.

The impact extends to confidentiality, integrity, and availability of browser state, including cached credentials and session data processed by the Passwords feature.

Root Cause

The root cause is insufficient validation of input consumed by the Passwords subsystem. Expected invariants are not enforced before the data reaches logic that performs memory or object operations. The Chromium issue tracker entry 562999635 documents the defect under Google's standard embargo process.

Attack Vector

The attack vector is network-based. A remote attacker hosts a crafted HTML page and lures a Chrome user to visit it, for example through phishing, malvertising, or a compromised site. No prior authentication is required.

Once the page is rendered, the malicious content triggers the vulnerable code path in the Passwords component and achieves arbitrary code execution within the sandboxed renderer process.

Detection Methods for CVE-2026-113046

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes shortly after navigation to an untrusted domain
Unexplained crashes or sandbox violations in chrome.exe renderer processes correlated with specific URLs
Outbound connections from the browser to newly registered or low-reputation domains serving HTML payloads

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 156.0.8078.47
Monitor browser telemetry and EDR process trees for anomalous renderer behavior, including unusual module loads and memory allocation patterns
Correlate web proxy logs with endpoint events to identify users visiting URLs that precede renderer crashes

Monitoring Recommendations

Enable Chrome crash reporting and forward reports to the SOC for triage
Alert on Chrome version drift where auto-update has stalled on managed endpoints
Track EPSS movement for CVE-2026-113046, currently 0.327% at the 24.532 percentile, to detect shifts in exploitation likelihood

How to Mitigate CVE-2026-113046

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all desktop endpoints
Verify that enterprise update policies are not blocking the stable channel rollout
Restart Chrome on managed endpoints to ensure the patched binary is loaded into memory

Patch Information

Google addressed CVE-2026-113046 in the Chrome stable channel release documented in the Google Chrome Stable Update. Technical tracking is available in Chromium Issue #562999635. Administrators should confirm that the deployed build is 156.0.8078.47 or newer.

Workarounds

Restrict browsing to trusted sites via enterprise URL allowlists until patching completes
Deploy Chrome Enterprise policies to disable or restrict the Passwords feature where operationally feasible
Enforce web filtering and DNS security controls to block known malicious domains serving crafted HTML payloads

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv