EUVD-2026-105466
GHSA-grqj-74w5-hj7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage triggers Compositing memory corruption
-
ExploitCorrupt heap and gain renderer control
-
ExecutionChain to sandbox escape
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Chrome (UI:R) - a crafted HTML page rendered by the Compositing pipeline on any affected build prior to 156.0.8078.47; no authentication or special configuration is needed since this targets default browser behavior. Limiting factors: the attacker must induce the user to visit malicious content (drive-by, malvertising, or link), and achieving the described sandbox escape realistically requires reliable heap manipulation and defeating Chrome's sandbox/ASLR mitigations, which raises practical exploit complexity above a trivial crash. Mitigated for anyone running the patched 156.0.8078.47 build or later. |
| Impact | This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a remote, unauthenticated, network-reachable memory-corruption flaw (CWE-119) in Chrome's Compositing component that, per the description, allows code execution OUTSIDE the renderer sandbox - a scope change (S:C) that correctly reflects escaping the browser sandbox into the host. The only meaningful barrier is UI:R: a victim must visit attacker-controlled content. Signals are mostly aligned: Chromium itself rated the security severity 'High', a vendor patch is available (fixed in 156.0.8078.47), and the flaw is RCE-class. However, several escalation signals are ABSENT in the input: no CISA KEV listing, no EPSS score provided, and no public exploit/POC referenced - so this should be treated as 'no public exploit identified at time of analysis' rather than active exploitation. One caution on the vector: a full sandbox-escaping memory-corruption bug typically demands heap grooming and defeating ASLR/sandbox mitigations, which argues for higher attack complexity than the AC:L in the input - see assessed vector. Net: patch urgently given Chrome's footprint and the reliability of browser-exploit weaponization over time, but current data does not show in-the-wild abuse. |
| Exploit ScenarioDerived | An attacker hosts or injects (e.g., via a malicious ad or compromised site) a crafted HTML page that triggers memory corruption in Chrome's Compositing code when rendered. A victim simply browsing to the page triggers the flaw, and because the impact is a sandbox escape, successful exploitation can run arbitrary code on the host outside the renderer sandbox. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Compositing component before 156.0.8078.47 can let an unauthenticated remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The issue requires user interaction to open the malicious content and, per independent assessment, has high practical attack complexity because reliable heap manipulation and defeat of sandbox/ASLR mitigations are needed. No public exploit was identified at time of analysis, and the vendor has released a fixed build.
RemediationAI
Update Google Chrome to 156.0.8078.47 or later, then fully restart the browser so the new binary is loaded; managed environments should push the vendor update through their enterprise patching or Chrome Browser Cloud Management policies and verify the version at chrome://settings/help. The vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is https://issues.chromium.org/issues/569286604. ChromeOS administrators should track the parallel ChromeOS stable-channel advisory at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html. Until the update is deployed, restrict browsing to trusted sites and filter known malicious or malvertising domains, understanding that this only reduces exposure and does not fix the flaw; keep the Chrome sandbox enabled and monitor renderer/GPU child-process crashes for signs of attempted exploitation, since disabling the sandbox would increase risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-113336 is a CWE-119 improper restriction of operations within the bounds of a memory buffer in Chrome's Compositing pipeline, the layer that combines rendered content into the final frame. A crafted HTML page can trigger the corruption in affected Chrome builds; the advisory describes potential arbitrary code execution outside the sandbox, which is why the assessed vector has scope change (S:C) and high confidentiality, integrity, and availability impact. The vector also requires user interaction (UI:R) and no privileges (PR:N), while the independent assessment raises attack complexity to AC:H because converting the memory corruption into a reliable sandbox escape requires heap manipulation and bypassing ASLR/sandbox mitigations. No CPE identifiers were supplied, and the available affected-version data points to Chrome releases below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote unauthenticated via web content (AV:N/PR:N/UI:R); AC:H because a reliable sandbox-escaping memory-corruption exploit requires heap grooming and mitigation bypass; S:C reflects code execution outside the sandbox with full host impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A critical memory-corruption flaw in Google Chrome's Compositing component could let a remote attacker execute code outside the browser sandbox if a user opens a crafted page, putting affected endpoints at risk of compromise. Leadership should prioritize remediation because Chrome is broadly deployed, though exploitation requires user interaction and significant technical effort, and no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB