---
id: "CVE-2026-113306"
kind: "vulnerability"
aliases: ["CVE-2026-113306"]
title: "Google Chrome: crafted web page can run code inside the browser sandbox"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "google chrome", "fixed": ["156.0.8078.47"], "affected": "< 156.0.8078.47", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["chrome", "desktop-browsers", "managed-endpoints", "other", "package"]
not_affected_if: ["already-on-156.0.8078.47-or-later"]
published_at: "2026-10-20T22:19:24+00:00"
first_seen_at: "2026-10-23T21:57:24+00:00"
updated_at: "2026-10-23T22:35:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113306", "first_seen_at": "2026-10-23T21:57:24+00:00"}]
---

# Google Chrome: crafted web page can run code inside the browser sandbox

Chrome versions before 156.0.8078.47 mishandle input in the Network component, so a malicious HTML page can run code inside the renderer sandbox. The sources score it high (CVSS 8.8) but note Chromium rates it Low severity, and sandbox code execution is one step short of full escape.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:google chrome affected < 156.0.8078.47 fixed 156.0.8078.47

## How to check

Open chrome://version in the browser and read the version number; anything below 156.0.8078.47 is affected.
On managed machines, check the Chrome version through the endpoint management console.

## Fix

Update Google Chrome to 156.0.8078.47 or later and restart the browser.

## Timeline

- 2026-10-23T21:57:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113306

## From the sources

Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_