CVE-2026-113085: Google Chrome Use After Free Vulnerability

CVE-2026-113085 Overview

CVE-2026-113085 is a use-after-free vulnerability in the Media component of Google Chrome versions prior to 156.0.8078.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to the victim. The flaw is tracked under CWE-416: Use After Free and requires user interaction, such as visiting a malicious website. Google classified the Chromium security severity as Low, while the NVD CVSS 3.1 score is 8.8. Exploitation remains constrained to code execution inside the renderer sandbox unless chained with a separate sandbox escape.

Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox through a single malicious web page visit.

Affected Products

Google Chrome Desktop versions prior to 156.0.8078.47
Chromium-based browsers that incorporate the vulnerable Media component
All platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-10-20 - CVE-2026-113085 published to the National Vulnerability Database
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113085

Vulnerability Analysis

The vulnerability resides in the Media subsystem of Chrome, which handles decoding, playback, and media stream management. A use-after-free condition occurs when the Media component continues to reference memory that has already been freed. An attacker who controls the lifecycle of media objects through JavaScript and HTML can trigger the dangling pointer and achieve code execution within the renderer process.

Because the attack vector is network-based and requires only user interaction with a crafted page, drive-by exploitation is viable. Code execution remains confined to the Chrome sandbox, limiting direct host compromise unless combined with a sandbox escape primitive.

Root Cause

The root cause is improper object lifetime management in the Media component [CWE-416]. The affected code releases a media-related object while another code path retains a reference. Subsequent access to the freed memory produces a use-after-free, which an attacker can shape into a controlled read, write, or indirect call.

Attack Vector

Exploitation requires a victim to load attacker-controlled HTML in a vulnerable Chrome build. The crafted page uses JavaScript APIs that interact with the Media component to trigger object allocation, release, and reuse in a specific order. Successful exploitation yields arbitrary code execution inside the renderer sandbox, which attackers typically pair with a second vulnerability to escape the sandbox and reach the host.

No public proof-of-concept, exploit database entry, or in-the-wild exploitation has been reported. Technical details are tracked in Chromium Issue Tracker #559776316.

Detection Methods for CVE-2026-113085

Indicators of Compromise

Chrome renderer process crashes with signatures referencing media playback or decoding components
Unexpected child processes spawned by chrome.exe or the renderer helper following media playback on untrusted sites
Outbound connections from Chrome renderer processes to newly registered or low-reputation domains hosting HTML with embedded media payloads
Browser telemetry showing version strings below 156.0.8078.47 after the patch release

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 156.0.8078.47
Monitor endpoint telemetry for renderer process crashes correlated with recent web navigation events
Correlate web proxy logs with crash telemetry to identify URLs that trigger renderer instability

Monitoring Recommendations

Enable browser crash reporting and forward reports to a centralized SIEM for triage
Alert on anomalous process ancestry involving Chrome renderer processes, such as unexpected shell or binary execution
Track EPSS score trends for CVE-2026-113085 (currently 0.327%) and reprioritize if exploit activity emerges

How to Mitigate CVE-2026-113085

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Verify Chromium-based browsers in the environment have incorporated the upstream fix
Communicate the update requirement to end users managing self-updating installations

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Administrators should confirm that endpoints have advanced to 156.0.8078.47 or newer. Technical tracking is available in Chromium Issue Tracker #559776316.

Workarounds

Restrict browsing to trusted sites via web proxy or DNS filtering until patching completes
Disable autoplay and media-related features via enterprise policy where operationally acceptable
Deploy site isolation and strict sandboxing policies through Chrome Enterprise policies to limit cross-origin impact

bash

# Verify installed Chrome version on Windows endpoints
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Expected output: 156.0.8078.47 or later