{"id":"CVE-2026-113290","kind":"vulnerability","aliases":["CVE-2026-113290"],"related":[],"title":"Chrome: use-after-free in Input lets a web page run code","description":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","summary":"A use-after-free in Chrome's Input component lets a crafted HTML page potentially run code inside the renderer sandbox. Chromium rates it Medium. Google found it internally. No exploitation or public PoC is known. Reaching the rest of the system would take a separate sandbox escape, and none is known.","severity":"medium","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google chrome","fixed":["156.0.8078.47"],"affected":"< 156.0.8078.47","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chrome","chromium","desktop","runtime"],"not_affected_if":["already-on-156.0.8078.47-or-later","managed-hosting"],"how_to_check":"Open chrome://settings/help, or chrome://version, and check the version. Anything below 156.0.8078.47 (Linux) or 156.0.8078.47/.48 (Windows/Mac) is exposed. For Debian Chromium run: dpkg -l chromium. Other Chromium-based browsers need their own vendor update.","fix":"Update Chrome to 156.0.8078.47 or later (156.0.8078.47/.48 on Windows and Mac), then relaunch the browser. On Debian trixie, install chromium 156.0.8078.47-1~deb13u1 (DSA-6577-1). The Debian tracker listed bookworm and forky as vulnerable when I read it.","status":"open","published_at":"2026-10-20T22:19:23+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","triaged_at":"2026-10-23T22:35:19+00:00","updated_at":"2026-10-24T00:04:07+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T22:35:19Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome to 156.0.8078.47 or later.","reach":"internet","title":"Chrome: use-after-free in Input lets a web page run code","impact":"high","summary":"A memory-safety bug in Chrome's Input component lets a crafted HTML page make the browser misuse freed memory. An attacker can potentially run arbitrary code inside the renderer sandbox.","category":"runtime","who_cares":["chrome","desktop","browsers"],"confidence":0.7,"needs_auth":"no","worst_case":"Code runs inside the browser sandbox after a user visits a crafted page","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["already-on-156.0.8078.47-or-later"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000445,"input_tokens":2940,"output_tokens":302,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Chrome release notes for 156.0.8078.47 and the Chromium bug entry to confirm the sandbox-only scope and whether any sandbox escape is known.","search":"'-113290':16A,19A '-2026':15A,18A '156.0.8078.47':90C 'allow':91C 'arbitrari':98C 'attack':94C 'browser':22B 'chrome':1A,21A,23B,33B,87C 'chromium':24B,49B,108C 'code':13A,44B,99C 'compon':36B 'craft':39B,105C 'cve':14A,17A 'desktop':25B 'escap':75B 'execut':97C 'exploit':58B 'found':54B 'free':5A,31B,82C 'googl':53B,86C 'google':20A 'html':40B,106C 'input':7A,35B,84C 'insid':45B,100C 'intern':56B 'known':63B,79B 'let':8A,37B 'medium':52B,111C 'none':77B 'page':11A,41B,107C 'poc':61B 'potenti':42B,96C 'prior':88C 'public':60B 'rate':50B 'reach':64B 'remot':93C 'render':47B 'rest':66B 'run':12A,43B 'runtim':26B 'sandbox':48B,74B,102C 'secur':109C 'separ':73B 'sever':110C 'system':69B 'take':71B 'use':3A,29B,80C 'use-after-fre':2A,28B 'via':103C 'web':10A 'would':70B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113290","severity":null,"published_at":"2026-10-20T22:19:23+00:00","modified_at":"2026-10-21T17:07:01+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113290:579","url":null,"severity":null,"published_at":"2026-10-24T00:04:04+00:00","modified_at":"2026-10-24T00:04:07+00:00","first_seen_at":"2026-10-24T00:04:04+00:00","fetched_at":"2026-10-24T00:04:07+00:00","note":"Correction: removed the not-affected-if tag managed-hosting from my previous write, since it does not apply to a desktop browser. Findings otherwise unchanged."}],"documents":[{"id":2327,"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","title":"Chrome Stable Channel Update for Desktop (156.0.8078.47), 2026-10-20","kind":"vendor","source":"analyst","text":"Chrome 156.0.8078.47 (Linux), 156.0.8078.47/.48 (Windows/Mac). 353 security fixes. [N/A][506152584] Medium CVE-2026-113290: Use after free in Input. Reported by Google on 2026-04-24.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2333,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113290","title":"CVE Record CVE-2026-113290","kind":"advisory","source":"analyst","text":"Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium). CWE-416. Refs: Chrome releases post, issues.chromium.org/issues/506152584.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2330,"url":"https://security-tracker.debian.org/tracker/CVE-2026-113290","title":"Debian security tracker CVE-2026-113290","kind":"other","source":"analyst","text":"Debian chromium: trixie (security) 156.0.8078.47-1~deb13u1 fixed; sid 156.0.8078.47-1 fixed; bookworm security 156.0.8078.47-1~deb12u1 listed vulnerable at fetch time; forky 154.0.8037.92-1 vulnerable. DSA-6577-1.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}