CVE-2026-113056: Google Chrome RCE Vulnerability

CVE-2026-113056 Overview

CVE-2026-113056 is a memory corruption vulnerability in the PerformanceAPIs component of Google Chrome versions prior to 156.0.8078.47. A remote attacker can exploit the flaw by hosting a crafted HTML page, triggering memory corruption that may lead to arbitrary code execution outside the browser sandbox. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Google rated the Chromium-level severity as Low, while the National Vulnerability Database assigned a CVSS score of 9.6 because the scope changes when a sandbox escape is possible.

Critical Impact

A single visit to an attacker-controlled web page can corrupt browser memory and execute code outside the Chrome sandbox, giving attackers a foothold on the host operating system.

Affected Products

• Google Chrome Desktop versions prior to 156.0.8078.47
• Chromium-based builds that incorporate the vulnerable PerformanceAPIs implementation
• Downstream browsers that embed the affected Blink rendering engine

Discovery Timeline

• 2026-10-20 - CVE-2026-113056 published to the National Vulnerability Database
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113056

Vulnerability Analysis

The flaw resides in Chrome's PerformanceAPIs, the component that exposes high-resolution timing and performance measurement interfaces to web content. Memory corruption in this surface is particularly impactful because PerformanceAPIs runs with privileges that touch both renderer-side timing structures and shared memory used by the browser process. The advisory indicates the condition can lead to code execution outside the sandbox, which means an attacker is not confined to the renderer process after successful exploitation. User interaction is required, consistent with a drive-by attack where a victim visits a crafted page. The scope-changed nature of the impact reflects the sandbox escape path, which elevates the overall risk beyond a typical renderer bug.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119] inside the PerformanceAPIs implementation. Specific details, such as the exact object type, allocator, or overflow primitive, have not been publicly disclosed. The Chromium Issue Tracker #502288792 remains access-restricted while patch adoption increases.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers malicious JavaScript that exercises the vulnerable PerformanceAPIs code path to corrupt memory. A successful exploit chain pivots from the renderer context through the sandbox boundary, allowing code execution with the privileges of the browser process. Common delivery methods include phishing links, malicious advertisements, and compromised third-party scripts loaded by otherwise legitimate sites.

No public exploit code or proof-of-concept has been published for this vulnerability. See the Google Chrome Stable Update advisory for official vendor details.

Detection Methods for CVE-2026-113056

Indicators of Compromise

• Chrome processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after browsing activity
• Unexplained outbound connections from chrome.exe to low-reputation domains hosting active content
• Browser crash reports referencing PerformanceAPIs, blink, or heap corruption signatures in Chrome versions below 156.0.8078.47

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any build below 156.0.8078.47 as vulnerable
• Monitor process lineage for anomalous child processes created by chrome.exe or its renderer processes
• Correlate web proxy logs with endpoint telemetry to identify users visiting newly observed domains preceding suspicious browser behavior

Monitoring Recommendations

• Enable crash telemetry collection and alert on repeated Chrome renderer or browser process crashes on the same host
• Watch for file writes to user-writable persistence locations originating from Chrome process trees
• Track Chrome auto-update status to confirm managed endpoints have reached the fixed build

How to Mitigate CVE-2026-113056

Immediate Actions Required

• Update Google Chrome Desktop to version 156.0.8078.47 or later on all Windows, macOS, and Linux endpoints
• Restart Chrome after the update completes so the patched binary is loaded by all browser and renderer processes
• Validate deployment status with endpoint management tooling and remediate hosts that have not updated

Patch Information

Google released the fix in the Chrome Stable channel at version 156.0.8078.47. Deployment details and channel notes are available in the Google Chrome Stable Update advisory. Administrators managing Chrome through enterprise policy should confirm the TargetVersionPrefix and update interval settings allow timely rollout.

Workarounds

• Restrict browsing to trusted sites using URL filtering or secure web gateways while patch deployment is in progress
• Enforce Site Isolation and ensure Chrome sandboxing features remain enabled through enterprise policy
• Use application allowlisting to block unexpected child processes spawned by Chrome

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise policy snippet to enforce minimum version via update channel
# (set in Chrome Enterprise policy management)
# TargetVersionPrefix = "156.0.8078.47"