---
id: "CVE-2026-113290"
kind: "vulnerability"
aliases: ["CVE-2026-113290"]
title: "Chrome: use-after-free in Input lets a web page run code"
severity: "medium"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "google chrome", "fixed": ["156.0.8078.47"], "affected": "< 156.0.8078.47", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "chrome", "chromium", "desktop", "runtime"]
not_affected_if: ["already-on-156.0.8078.47-or-later", "managed-hosting"]
published_at: "2026-10-20T22:19:23+00:00"
first_seen_at: "2026-10-23T21:57:24+00:00"
updated_at: "2026-10-24T00:04:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113290", "first_seen_at": "2026-10-23T21:57:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:04:04+00:00"}]
---

# Chrome: use-after-free in Input lets a web page run code

A use-after-free in Chrome's Input component lets a crafted HTML page potentially run code inside the renderer sandbox. Chromium rates it Medium. Google found it internally. No exploitation or public PoC is known. Reaching the rest of the system would take a separate sandbox escape, and none is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:google chrome affected < 156.0.8078.47 fixed 156.0.8078.47

## How to check

Open chrome://settings/help, or chrome://version, and check the version. Anything below 156.0.8078.47 (Linux) or 156.0.8078.47/.48 (Windows/Mac) is exposed. For Debian Chromium run: dpkg -l chromium. Other Chromium-based browsers need their own vendor update.

## Fix

Update Chrome to 156.0.8078.47 or later (156.0.8078.47/.48 on Windows and Mac), then relaunch the browser. On Debian trixie, install chromium 156.0.8078.47-1~deb13u1 (DSA-6577-1). The Debian tracker listed bookworm and forky as vulnerable when I read it.

## Timeline

- 2026-10-23T21:57:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113290
- 2026-10-24T00:04:04+00:00 analyst — Correction: removed the not-affected-if tag managed-hosting from my previous write, since it does not apply to a desktop browser. Findings otherwise unchanged.

## Documents

- [advisory] Chrome Stable Channel Update for Desktop (156.0.8078.47), 2026-10-20 https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
- [describes] CVE Record CVE-2026-113290 https://www.cve.org/CVERecord?id=CVE-2026-113290
- [fix] Debian security tracker CVE-2026-113290 https://security-tracker.debian.org/tracker/CVE-2026-113290

## From the sources

Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_