Live › vulnerability › CVE-2026-113047
Go to dashboardA memory corruption bug in the BrowserTag component of Google Chrome, before 156.0.8078.47, lets a remote attacker read memory inside the browser sandbox when a victim opens a crafted HTML page. The attacker gets information from the sandboxed renderer, not code execution outside the sandbox according to the source description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any machine running Google Chrome before 156.0.8078.47 is exposed when a user visits an attacker-controlled page. Teams that manage browsers on endpoints should check their fleet; servers without a graphical browser are unlikely to be affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
chrome --version (or check the version under chrome://settings/help) and compare with 156.0.8078.47156.0.8078.47 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-113047")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.