CVE-2026-113081: Google Chrome Use After Free Vulnerability

CVE-2026-113081 Overview

CVE-2026-113081 is a use-after-free vulnerability in the Compositing component of Google Chrome. The flaw affects Chrome versions prior to 156.0.8078.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The vulnerability is tracked as CWE-416 and requires user interaction to trigger. Google rated the Chromium security severity as Medium, while NVD assigned a higher CVSS base score reflecting the arbitrary code execution impact.

Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox, providing an attacker a foothold for further sandbox escape or data theft.

Affected Products

Google Chrome versions prior to 156.0.8078.47 on desktop platforms
Chromium-based browsers that inherit the vulnerable Compositing code
Embedded applications using older Chromium Content layers

Discovery Timeline

2026-10-20 - CVE-2026-113081 published to the National Vulnerability Database
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113081

Vulnerability Analysis

The vulnerability resides in Chrome's Compositing subsystem, which manages the rendering of layered graphical content in the browser. A use-after-free condition occurs when the Compositing code accesses a memory object that has already been released. An attacker who controls the lifecycle of compositor objects through crafted HTML, CSS, or JavaScript can reclaim the freed memory and influence subsequent reads or writes. This primitive leads to arbitrary code execution inside the renderer sandbox. Exploitation requires the victim to load an attacker-controlled page, which aligns with the User Interaction Required scope.

Root Cause

The root cause is improper lifetime management of compositor objects, classified under [CWE-416] Use After Free. A reference to a Compositing object persists after the backing allocation is freed, and later operations dereference the stale pointer. Attackers typically trigger this by racing layer updates, animations, or rendering state changes against object destruction. Full technical details are tracked in the Chromium Issue Tracker entry.

Attack Vector

Exploitation is network-based. An attacker hosts a malicious HTML page or injects crafted content into a legitimate site through advertising, iframes, or compromised third-party resources. When the victim loads the page, JavaScript manipulates DOM and compositor state to free the target object while a dangling reference remains. The attacker then sprays the heap to control the freed region and gains code execution within the sandboxed renderer process. See Chromium security details in the Chromium Issue Tracker entry.

Detection Methods for CVE-2026-113081

Indicators of Compromise

Chrome processes crashing with access violations or heap corruption signatures while rendering untrusted pages
Renderer processes spawning unexpected child processes or performing anomalous outbound network connections
Browser telemetry showing navigation to newly registered domains immediately followed by renderer crashes

Detection Strategies

Inventory Chrome installations and flag any build earlier than 156.0.8078.47 as vulnerable
Correlate browser crash dumps with URL history to identify repeatable crashes tied to specific sites
Monitor EDR telemetry for chrome.exe renderer processes exhibiting shellcode-like behavior or unexpected memory allocations

Monitoring Recommendations

Collect Chrome crash reports centrally and alert on recurring renderer faults in Compositing modules
Track outbound DNS and HTTP activity from browser processes for connections to low-reputation infrastructure
Enforce browser version reporting through management tooling and alert on hosts running out-of-date builds

How to Mitigate CVE-2026-113081

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all desktop endpoints
Restart Chrome after the update to ensure the patched binaries are loaded
Verify Chromium-based browsers and embedded clients incorporate the fixed Chromium release

Patch Information

Google addressed CVE-2026-113081 in the Chrome stable channel update documented in the Google Chrome Stable Update. Administrators should confirm clients have received 156.0.8078.47 or newer and that auto-update is functioning. Chromium downstream maintainers must rebase on the patched source and ship updated packages to their users.

Workarounds

Enforce enterprise policies that require Chrome auto-update and block execution of out-of-date builds
Restrict browsing to trusted sites via web filtering while patch rollout is in progress
Disable or restrict JavaScript on untrusted origins using Chrome enterprise policies where feasible

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on Linux
google-chrome --version