Live › vulnerability › CVE-2026-113139
Go to dashboardA memory corruption bug in Chrome's Autofill feature lets a remote attacker read memory inside the browser sandbox when the victim visits a crafted HTML page. The sources describe this as a read-only information leak with a Chromium severity of Medium, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Google Chrome before on desktops or devices where users browse the web. The exposure is a visited crafted page, so any browser user who reaches an untrusted site is in scope. Teams with Chrome already at or later can skip it.
156.0.8078.47156.0.8078.47| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
chrome://version in Chrome and compare the version shown against 156.0.8078.47156.0.8078.47 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memory corruption in Autofill in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-113139")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.