---
id: "CVE-2026-113310"
kind: "vulnerability"
aliases: ["CVE-2026-113310"]
title: "Google Chrome: Bluetooth out-of-bounds read leaks sandbox memory via crafted page"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "google chrome", "fixed": ["156.0.8078.47"], "affected": "< 156.0.8078.47", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browser", "chrome", "desktop", "managed-fleet", "package"]
not_affected_if: ["chrome-updated", "no-chrome-installed"]
published_at: "2026-10-20T22:19:25+00:00"
first_seen_at: "2026-10-23T21:57:24+00:00"
updated_at: "2026-10-25T03:52:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113310", "first_seen_at": "2026-10-23T21:57:24+00:00"}]
---

# Google Chrome: Bluetooth out-of-bounds read leaks sandbox memory via crafted page

A flaw in Chrome's Bluetooth code lets a crafted HTML page read memory outside an intended buffer, but only inside the browser sandbox. An attacker gets information from the browser process memory space, not direct code execution from the page alone.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:google chrome affected < 156.0.8078.47 fixed 156.0.8078.47

## How to check

- Run `chrome://version` in Google Chrome and compare the version with `156.0.8078.47`
- On managed fleets, check the installed Chrome version reported by the device management console

## Fix

- Update Google Chrome to `156.0.8078.47` or later
- Relaunch the browser after the update so the fixed build is running

## Timeline

- 2026-10-23T21:57:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113310

## From the sources

Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_