{"id":"CVE-2026-113209","kind":"vulnerability","aliases":["CVE-2026-113209"],"related":[],"title":"Chrome on iOS: navigation memory corruption lets a web page read sandbox memory","description":"Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","summary":"A memory corruption bug in Navigation in Google Chrome on iOS, before 156.0.8078.47, lets a remote attacker read memory inside the browser sandbox. The attack is triggered by a crafted HTML page the user opens.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","ios","other"],"not_affected_if":["fixed-version"],"how_to_check":"- Open Chrome on iOS and check the version under Settings > Google Chrome > About Chrome, or run `unknown` on managed devices if the sources do not say how to query it.","fix":"- Update Chrome on iOS to `156.0.8078.47` or later through the App Store.","status":"open","published_at":"2026-10-20T22:19:13+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","triaged_at":"2026-10-25T03:53:04+00:00","updated_at":"2026-10-25T03:53:04+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:53:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update Chrome on iOS to `156.0.8078.47` or later through the App Store.","reach":"internet","title":"Chrome on iOS: navigation memory corruption lets a web page read sandbox memory","impact":"low","summary":"A memory corruption bug in Navigation in Google Chrome on iOS, before 156.0.8078.47, lets a remote attacker read memory inside the browser sandbox. The attack is triggered by a crafted HTML page the user opens.","category":"other","nicknames":[],"who_cares":["chrome","ios","browser"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads memory inside the browser sandbox via a crafted page.","analyst_note":"","how_to_check":"- Open Chrome on iOS and check the version under Settings > Google Chrome > About Chrome, or run `unknown` on managed devices if the sources do not say how to query it.","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"Users of Google Chrome on iOS older than 156.0.8078.47 who open untrusted web pages are exposed. Systems that do not run Chrome on iOS, and devices already on the fixed version, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000561,"input_tokens":3309,"output_tokens":461,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113209':16A,19A '-2026':15A,18A '156.0.8078.47':35B,70C 'allow':71C 'attack':39B,47B,74C 'browser':20B,44B 'bug':26B 'chrome':1A,21B,31B,64C 'chromium':87C 'corrupt':6A,25B,59C 'craft':52B,84C 'cve':14A,17A 'googl':30B,63C 'html':53B,85C 'insid':42B,79C 'io':3A,22B,33B,67C 'let':7A,36B 'medium':90C 'memori':5A,13A,24B,41B,58C,78C 'navig':4A,28B,61C 'open':57B 'page':10A,54B,86C 'potenti':76C 'prior':68C 'read':11A,40B,77C 'remot':38B,73C 'sandbox':12A,45B,81C 'secur':88C 'sever':89C 'trigger':49B 'user':56B 'via':82C 'web':9A","nicknames":[],"mitigations":[],"who_affected":"Users of Google Chrome on iOS older than 156.0.8078.47 who open untrusted web pages are exposed. Systems that do not run Chrome on iOS, and devices already on the fixed version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113209","severity":null,"published_at":"2026-10-20T22:19:13+00:00","modified_at":"2026-10-21T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}