Live › vulnerability › CVE-2026-113066
Go to dashboardA memory corruption bug in Chrome's font handling lets a remote attacker read memory inside the browser sandbox when the victim opens a crafted HTML page. The sources describe a read-only memory disclosure, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any device running Google Chrome before is exposed when a user visits a malicious or compromised web page. Teams that run only fully updated Chrome, or that browse with auto-update enabled and a current version, can skip it. Chromium-based browsers that ship their own Chrome build may need their own update.
156.0.8078.47| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
chrome://settings/help and note the version; it is affected if it is below 156.0.8078.47google-chrome --version (Linux) or check the installed version through your device management console156.0.8078.47 or later, then restart the browserEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memory corruption in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-113066")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.