CVE-2026-113075: Google Chrome Use-After-Free Vulnerability

CVE-2026-113075 Overview

CVE-2026-113075 is a use-after-free vulnerability in the DevTools component of Google Chrome prior to version 156.0.8078.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw is tracked under CWE-416 and requires user interaction to trigger. Google rates the Chromium security severity as Medium, while NVD assigns a CVSS 3.1 base score of 8.8 (High) due to the network attack vector and the potential for full compromise of confidentiality, integrity, and availability within the sandboxed renderer context.

Critical Impact
Successful exploitation allows arbitrary code execution inside the Chrome sandbox through a single crafted web page, enabling drive-by compromise of Chrome users on vulnerable builds.

Affected Products

Google Chrome versions prior to 156.0.8078.47 (Desktop)
Chromium-based browsers that embed the vulnerable DevTools component
All operating systems running affected Chrome builds (Windows, macOS, Linux)

Discovery Timeline

2026-10-20 - CVE-2026-113075 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113075

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition in Chrome's DevTools subsystem. DevTools is the integrated debugging and inspection interface accessible from the browser. A UAF occurs when code continues to reference a heap object after that object has been freed. Attackers can groom the heap to replace the freed region with attacker-controlled data, then trigger the dangling reference to redirect control flow.

In this case, the dangling pointer is reachable from content loaded in a crafted HTML page, allowing a remote attacker to execute arbitrary code within the renderer sandbox. Exploitation requires user interaction, consistent with the UI:R component of the CVSS vector. The flaw does not by itself break out of the sandbox, but it is a strong primitive that is commonly chained with a sandbox escape to achieve full host compromise.

Root Cause

The root cause is improper object lifetime management inside the DevTools frontend or its bindings. A DevTools object is freed while another code path retains a reference to it. When that stale reference is later dereferenced, memory that an attacker has reclaimed through heap spraying is interpreted as a valid object, enabling type confusion and arbitrary code execution within the renderer process. Technical details are restricted in Chromium Issue Report #553931271 pending broad patch adoption.

Attack Vector

An attacker hosts a malicious HTML page that interacts with DevTools APIs or triggers the vulnerable code path through scripted browser actions. The victim must visit the page and perform the triggering interaction. Once the UAF fires, the attacker gains code execution inside the sandboxed renderer. Pairing this bug with a separate sandbox escape would allow full compromise of the host.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score at publication is 0.406%.

Detection Methods for CVE-2026-113075

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures originating from DevTools modules
Unexpected child processes spawned from chrome.exe or the Chrome renderer following visits to untrusted sites
Outbound connections from Chrome renderer processes to attacker-controlled infrastructure immediately after HTML page loads

Detection Strategies

Inventory Chrome installations and flag any build earlier than 156.0.8078.47 as vulnerable
Monitor endpoint telemetry for anomalous memory access patterns, renderer crashes, or shellcode-like behavior inside Chrome processes
Correlate browser crash reports with recent URL history to identify attempted exploitation attempts

Monitoring Recommendations

Ingest Chrome crash telemetry and WER (Windows Error Reporting) data into the security data lake for retrospective hunting
Alert on process-tree anomalies where a Chrome renderer launches scripting interpreters, LOLBins, or performs credential access
Track DNS and proxy logs for Chrome-originated requests to newly observed domains that correspond to recent browsing sessions

How to Mitigate CVE-2026-113075

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all Windows, macOS, and Linux endpoints
Restart browsers after patch deployment to ensure the vulnerable code is unloaded from memory
Audit managed Chromium-based browsers and apply upstream fixes once vendors ship corresponding builds

Patch Information

Google addressed CVE-2026-113075 in the Chrome Stable channel update detailed in the Google Chrome Stable Update advisory. Administrators should push the update through enterprise management tools such as Chrome Browser Cloud Management, Group Policy, or MDM profiles to force a browser restart after installation.

Workarounds

Where immediate patching is not possible, restrict browsing to trusted sites via web proxy allow-lists until the update is deployed
Disable or restrict DevTools usage on managed fleets through the DeveloperToolsAvailability enterprise policy to reduce attack surface
Enforce Site Isolation and ensure sandboxing is enabled to limit renderer-level code execution impact

bash

# Example Chrome enterprise policy to restrict DevTools (Windows registry)
# HKLM\Software\Policies\Google\Chrome\DeveloperToolsAvailability = 2
# 2 = DeveloperToolsDisallowed
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f