CVE-2026-113109 Overview
CVE-2026-113109 is a memory corruption vulnerability in Google Chrome versions prior to 156.0.8078.47. The flaw resides in a browser API component and allows a remote attacker to potentially execute arbitrary code inside the Chrome sandbox. Exploitation requires the victim to visit a crafted HTML page, meaning user interaction is a prerequisite. Google tracks the issue under Chromium bug 495471295 and classifies the Chromium security severity as Medium. The weakness is categorized as [CWE-119], improper restriction of operations within the bounds of a memory buffer.
Critical Impact
A remote attacker can trigger memory corruption and execute arbitrary code inside the Chrome sandbox when a user loads a malicious HTML page.
Affected Products
- Google Chrome Desktop prior to 156.0.8078.47
- Chromium-based browsers that incorporate the vulnerable API code before the Chrome 156 merge
- Embedded applications bundling pre-156 Chromium builds
Discovery Timeline
- 2026-10-20 - CVE-2026-113109 published to the National Vulnerability Database
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-113109
Vulnerability Analysis
The vulnerability is a memory corruption condition in a Chrome API component, classified under [CWE-119]. An attacker crafts an HTML page that drives the vulnerable API into an unsafe memory operation when a user loads the page. Successful exploitation corrupts process memory inside the renderer, enabling arbitrary code execution within the Chrome sandbox.
Code running inside the sandbox is confined, but it provides a reliable foothold for chaining a sandbox escape. Combined with a secondary escape primitive, this class of bug typically yields full renderer-to-host compromise. The attack is network-reachable and requires only that the target visit attacker-controlled content.
Google resolved the issue in the stable channel release at version 156.0.8078.47. Public technical details remain restricted in Chromium issue tracker entry 495471295, which is standard practice until a majority of users have updated.
Root Cause
The root cause is improper enforcement of memory buffer boundaries within a Chrome API implementation. The vulnerable code path mishandles size, type, or lifetime assumptions when processing attacker-influenced data from an HTML page. This produces an exploitable memory corruption primitive accessible from the renderer.
Attack Vector
An attacker hosts a crafted HTML page on a controlled domain or injects malicious content through compromised sites and malvertising. When a Chrome user with a pre-156.0.8078.47 build visits the page, the API processes attacker data and corrupts memory. Code execution occurs inside the Chrome sandbox without additional privileges.
No verified proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium issue tracker for upstream references.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-113109
Indicators of Compromise
- Chrome renderer processes crashing on specific URLs with heap corruption signatures in crash reports
- Unexpected child process creation from chrome.exe following navigation to untrusted domains
- Outbound connections from Chrome renderer processes to unfamiliar command-and-control infrastructure after rendering suspicious HTML
Detection Strategies
- Inventory Chrome installations and flag endpoints running versions below 156.0.8078.47
- Correlate browser crash telemetry with web navigation logs to identify pages triggering repeated renderer failures
- Hunt for anomalous process lineage where Chrome spawns shells, scripting hosts, or living-off-the-land binaries
Monitoring Recommendations
- Forward Chrome crash dumps and Windows Error Reporting events to a centralized log pipeline for correlation
- Monitor DNS and proxy logs for user navigation to newly registered or low-reputation domains serving HTML payloads
- Track Chrome version drift across managed endpoints and alert when hosts fall behind the patched build
How to Mitigate CVE-2026-113109
Immediate Actions Required
- Update Google Chrome to version 156.0.8078.47 or later on all managed endpoints
- Restart Chrome after the update completes so the patched binary loads into memory
- Audit Chromium-based browsers and embedded webviews for inclusion of the fix and apply vendor updates
Patch Information
Google shipped the fix in the Chrome Stable channel. Administrators should deploy build 156.0.8078.47 or newer through enterprise update infrastructure. Release details are available in the Google Chrome Stable Update advisory.
Workarounds
- Enforce Chrome auto-update policies through group policy or MDM to prevent version drift
- Restrict high-risk browsing on unpatched hosts using web filtering and proxy policies until updates are applied
- Enable Enhanced Safe Browsing to add a layer of real-time protection against malicious HTML content
# Verify Chrome version on managed Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Force update check on Linux
google-chrome --version
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
