{"id":"CVE-2026-113338","kind":"vulnerability","aliases":["CVE-2026-113338"],"related":[],"title":"Chrome: use-after-free in Turbolev lets a web page run code","description":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A memory bug in Turbolev, Chrome's JavaScript engine component, lets a remote attacker run arbitrary code inside the browser sandbox by serving a crafted HTML page. Visiting the malicious page is enough to trigger it, and the sandbox is still in place, so the attacker does not get full system control from this alone.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google chrome","fixed":["156.0.8078.47"],"affected":"< 156.0.8078.47","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","chrome","desktop","managed-browsers","runtime"],"not_affected_if":["already-on-156.0.8078.47-or-later"],"how_to_check":"Run chrome://version in the browser and compare the Chrome version to 156.0.8078.47.\nOn managed fleets, query the installed Chrome version with your MDM or endpoint tool.","fix":"Update Google Chrome to 156.0.8078.47 or later and restart the browser.","status":"open","published_at":"2026-10-20T22:19:28+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","triaged_at":"2026-10-23T22:34:52+00:00","updated_at":"2026-10-23T22:34:52+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:34:52Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome to 156.0.8078.47 or later and restart the browser.","reach":"internet","title":"Chrome: use-after-free in Turbolev lets a web page run code","impact":"high","summary":"A memory bug in Turbolev, Chrome's JavaScript engine component, lets a remote attacker run arbitrary code inside the browser sandbox by serving a crafted HTML page. Visiting the malicious page is enough to trigger it, and the sandbox is still in place, so the attacker does not get full system control from this alone.","category":"runtime","who_cares":["chrome","desktop","managed-browsers"],"confidence":0.8,"needs_auth":"no","worst_case":"Code runs inside the browser sandbox after visiting a crafted page.","analyst_note":"","how_to_check":"Run chrome://version in the browser and compare the Chrome version to 156.0.8078.47.\nOn managed fleets, query the installed Chrome version with your MDM or endpoint tool.","needs_analyst":false,"not_affected_if":["already-on-156.0.8078.47-or-later"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":2949,"output_tokens":416,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113338':16A,19A '-2026':15A,18A '156.0.8078.47':94C 'allow':95C 'alon':83B 'arbitrari':44B,101C 'attack':42B,74B,98C 'browser':22B,27B,48B 'bug':31B 'chrome':1A,21A,23B,34B,91C 'chromium':111C 'code':13A,45B,102C 'compon':38B 'control':80B 'craft':53B,108C 'cve':14A,17A 'desktop':24B 'engin':37B 'enough':61B 'execut':100C 'free':5A,86C 'full':78B 'get':77B 'googl':90C 'google':20A 'high':114C 'html':54B,109C 'insid':46B,103C 'javascript':36B 'let':8A,39B 'malici':58B 'manag':26B 'managed-brows':25B 'memori':30B 'page':11A,55B,59B,110C 'place':71B 'prior':92C 'remot':41B,97C 'run':12A,43B 'runtim':28B 'sandbox':49B,67B,105C 'secur':112C 'serv':51B 'sever':113C 'still':69B 'system':79B 'trigger':63B 'turbolev':7A,33B,88C 'use':3A,84C 'use-after-fre':2A 'via':106C 'visit':56B 'web':10A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113338","severity":null,"published_at":"2026-10-20T22:19:28+00:00","modified_at":"2026-10-21T17:02:53+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}