Live › vulnerability › CVE-2026-113309
Go to dashboardA bug in Chrome's Media component lets a remote attacker read memory inside the browser sandbox when a victim opens a crafted HTML page. The sources say the read is limited to sandbox memory, so it is an information-disclosure step rather than direct code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Google Chrome before who browses the web on the affected machine is exposed, since the trigger is a crafted HTML page the user visits. Servers and automated systems that do not run Chrome as a browser for users can skip it, and so can teams where every device is already on the fixed build.
156.0.8078.47| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
chrome://version in Chrome and compare the version to 156.0.8078.47.156.0.8078.47.156.0.8078.47 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-113309")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.