---
id: "CVE-2026-113049"
kind: "vulnerability"
aliases: ["CVE-2026-113049"]
title: "Chrome: memory corruption lets a crafted web page run code in sandbox"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "google chrome", "fixed": ["156.0.8078.47"], "affected": "< 156.0.8078.47", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "chrome", "desktop", "other", "runtime"]
not_affected_if: ["version-156.0.8078.47-or-later"]
published_at: "2026-10-20T22:18:56+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-23T22:37:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113049", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Chrome: memory corruption lets a crafted web page run code in sandbox

A memory corruption bug in Chrome's core code lets an attacker who lures a user to a crafted HTML page potentially run arbitrary code inside the browser sandbox. The sources say the flaw is fixed in Chrome 156.0.8078.47 and rate it high (CVSS 8.8) with the Chromium security severity Medium.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:google chrome affected < 156.0.8078.47 fixed 156.0.8078.47

## How to check

Open chrome://version in Chrome and compare the version with 156.0.8078.47.

## Fix

Update Google Chrome to 156.0.8078.47 or later.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113049

## From the sources

Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_