{"id":"CVE-2026-113178","kind":"vulnerability","aliases":["CVE-2026-113178"],"related":[],"title":"Google Chrome on Mac: memory corruption in Views lets a web page read memory","description":"Memory corruption in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","summary":"A memory corruption flaw in the Views component of Google Chrome on macOS lets a remote attacker potentially read memory inside the browser sandbox via a crafted HTML page. The sources rate it Chromium medium severity with a CVSS score of 6.5.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google chrome","fixed":["156.0.8078.47"],"affected":"< 156.0.8078.47","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","chrome","desktop-fleet","macos","vendor"],"not_affected_if":["chrome-up-to-date","non-mac"],"how_to_check":"- Run `chrome://version` in Chrome on Mac and compare the version with `156.0.8078.47`\n- Check the installed version with `/Applications/Google Chrome.app/Contents/Info.plist` (key `CFBundleShortVersionString`)","fix":"- Update Google Chrome on Mac to `156.0.8078.47` or later\n- Restart the browser after the update so the new version is running","status":"open","published_at":"2026-10-20T22:19:10+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","triaged_at":"2026-10-25T03:53:08+00:00","updated_at":"2026-10-25T03:53:08+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:53:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update Google Chrome on Mac to `156.0.8078.47` or later\n- Restart the browser after the update so the new version is running","reach":"internet","title":"Google Chrome on Mac: memory corruption in Views lets a web page read memory","impact":"low","summary":"A memory corruption flaw in the Views component of Google Chrome on macOS lets a remote attacker potentially read memory inside the browser sandbox via a crafted HTML page. The sources rate it Chromium medium severity with a CVSS score of 6.5.","category":"vendor","nicknames":[],"who_cares":["chrome","macos","browser","desktop-fleet"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads some memory inside the browser sandbox via crafted page","analyst_note":"","how_to_check":"- Run `chrome://version` in Chrome on Mac and compare the version with `156.0.8078.47`\n- Check the installed version with `/Applications/Google Chrome.app/Contents/Info.plist` (key `CFBundleShortVersionString`)","needs_analyst":false,"not_affected_if":["chrome-up-to-date","non-mac"],"who_is_affected":"Any Mac with Google Chrome older than `156.0.8078.47` is affected when a user visits a malicious or compromised web page. Managed fleets that pin Chrome versions should confirm the update reached every machine. Systems where Chrome is not installed, or where it is already at or above the fixed version, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3337,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113178':17A,20A '-2026':16A,19A '156.0.8078.47':84C '6.5':71B 'allow':85C 'attack':46B,88C 'browser':23B,52B 'chrome':2A,22A,24B,40B,78C 'chromium':63B,101C 'compon':37B 'corrupt':6A,32B,73C 'craft':56B,98C 'cve':15A,18A 'cvss':68B 'desktop':26B 'desktop-fleet':25B 'flaw':33B 'fleet':27B 'googl':1A,39B,77C 'google':21A 'html':57B,99C 'insid':50B,93C 'let':9A,43B 'mac':4A,81C 'maco':28B,42B 'medium':64B,104C 'memori':5A,14A,31B,49B,72C,92C 'page':12A,58B,100C 'potenti':47B,90C 'prior':82C 'rate':61B 'read':13A,48B,91C 'remot':45B,87C 'sandbox':53B,95C 'score':69B 'secur':102C 'sever':65B,103C 'sourc':60B 'vendor':29B 'via':54B,96C 'view':8A,36B,75C 'web':11A","nicknames":[],"mitigations":[],"who_affected":"Any Mac with Google Chrome older than `156.0.8078.47` is affected when a user visits a malicious or compromised web page. Managed fleets that pin Chrome versions should confirm the update reached every machine. Systems where Chrome is not installed, or where it is already at or above the fixed version, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113178","severity":null,"published_at":"2026-10-20T22:19:10+00:00","modified_at":"2026-10-22T15:26:03+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}