---
id: "CVE-2026-113137"
kind: "vulnerability"
aliases: ["CVE-2026-113137"]
title: "Chrome: extensions memory corruption lets a web page read sandbox memory"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "google chrome", "fixed": ["156.0.8078.47"], "affected": "< 156.0.8078.47", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["chrome", "linux", "macos", "other", "package", "windows"]
not_affected_if: ["already-on-156.0.8078.47-or-later"]
published_at: "2026-10-20T22:19:05+00:00"
first_seen_at: "2026-10-23T21:57:24+00:00"
updated_at: "2026-10-23T22:36:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113137", "first_seen_at": "2026-10-23T21:57:24+00:00"}]
---

# Chrome: extensions memory corruption lets a web page read sandbox memory

A crafted HTML page can corrupt memory in the Chrome Extensions component, letting an attacker read memory inside the browser sandbox. The sources say the impact is potential sandbox memory read, not code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:google chrome affected < 156.0.8078.47 fixed 156.0.8078.47

## How to check

Open chrome://version and compare the version with 156.0.8078.47.
On managed machines, check the Chrome version through the device management console or software inventory.

## Fix

Update Google Chrome to 156.0.8078.47 or later and relaunch the browser.

## Timeline

- 2026-10-23T21:57:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113137

## From the sources

Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_