Live › vulnerability › CVE-2026-113070
Go to dashboardA flaw in Chrome's GetUserMedia media capture code lets a crafted HTML page read memory inside the browser sandbox. The sources describe a memory read only, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Google Chrome before who visits untrusted web pages is exposed, since the attack is triggered by a crafted HTML page. Chromium-based browsers that have not picked up the fix may be affected too, but the sources only name Chrome. Managed fleets with auto-update enabled are likely already patched.
156.0.8078.47| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
chrome://version and confirm the version is at least 156.0.8078.47.google-chrome --version on Linux or the installed app version on macOS and Windows.156.0.8078.47 or later, then restart the browser.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-113070")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.