Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-113147 Overview
CVE-2026-113147 is an improper input validation vulnerability in the WebShare component of Google Chrome. Versions prior to 156.0.8078.47 allow a remote attacker to execute arbitrary code inside the browser sandbox using a crafted HTML page. The flaw is categorized under CWE-20: Improper Input Validation and was rated Medium severity by the Chromium security team. Exploitation requires user interaction, such as visiting a malicious website. Successful exploitation grants code execution inside the renderer sandbox, which can be chained with a sandbox escape for full host compromise.
Critical Impact
A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to load a crafted HTML page targeting the WebShare API.
Affected Products
- Google Chrome Desktop versions prior to 156.0.8078.47
- Chromium-based browsers that incorporate the vulnerable WebShare implementation
- All operating system builds of Chrome shipped before the October 2026 Stable channel update
Discovery Timeline
- 2026-10-20 - CVE-2026-113147 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-113147
Vulnerability Analysis
The vulnerability resides in Chrome's WebShare implementation, which exposes the navigator.share() JavaScript API to web content. WebShare allows pages to invoke the operating system's native share dialog with text, URLs, or file payloads. Insufficient validation of input passed through this API path lets attacker-controlled data reach code paths that assume well-formed arguments. An attacker who hosts a crafted HTML page can trigger the condition when a victim interacts with the page. The outcome is arbitrary code execution confined to the Chrome sandbox process, typically the renderer context.
Root Cause
The root cause is improper validation of parameters supplied to the WebShare API before they are consumed by downstream handling logic. When the browser processes malformed share payloads, assumptions about structure, length, or type are violated. These violations lead to memory or state corruption that an attacker can shape into controlled execution. The Chromium issue tracker entry #501531546 tracks the specific fix.
Attack Vector
Exploitation is remote and network-based but requires user interaction. The attacker hosts a malicious page or injects content into a compromised site. When the victim visits the page and interacts with it, the page invokes navigator.share() with crafted parameters. The resulting code execution occurs inside the sandboxed renderer. A separate sandbox escape vulnerability would be required to achieve code execution on the host operating system.
No verified public proof-of-concept code is available at the time of writing. See the Google Chrome Desktop Update advisory for release-level details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-113147
Indicators of Compromise
- Chrome processes with versions earlier than 156.0.8078.47 observed in endpoint inventory data
- Renderer processes spawning unexpected child processes or performing unusual file and network activity shortly after loading an external page
- Browser crash reports referencing the WebShare or navigator.share code paths
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 156.0.8078.47 for remediation
- Monitor web proxy and DNS logs for user navigation to newly observed or low-reputation domains that serve HTML pages invoking the WebShare API
- Correlate Chrome renderer crashes with subsequent process creation events to identify potential exploit chains
Monitoring Recommendations
- Ingest browser version telemetry and crash dumps into a central analytics pipeline for continuous version compliance checks
- Alert on anomalous child-process creation from chrome.exe renderer processes, particularly cmd.exe, powershell.exe, or script interpreters
- Track outbound connections initiated by Chrome to uncategorized domains following share-dialog interactions
How to Mitigate CVE-2026-113147
Immediate Actions Required
- Update Google Chrome Desktop to version 156.0.8078.47 or later across all managed endpoints
- Force-restart Chrome on user devices to ensure the patched binary is loaded after the update is applied
- Verify Chromium-based third-party browsers have incorporated the upstream fix before considering them remediated
Patch Information
Google addressed the issue in the Stable channel update documented at the Google Chrome Desktop Update release notes. The fixed version is 156.0.8078.47. Technical fix details are referenced in Chromium Issue Tracker #501531546.
Workarounds
- Enable automatic updates through Chrome's built-in updater or enterprise management policies to minimize patch latency
- Restrict browsing to trusted sites via web filtering until all endpoints are confirmed on the patched build
- Deploy enterprise policies that limit exposure to untrusted HTML content, such as blocking execution of unknown attachments and tightening Site Isolation settings
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
