---
id: "CVE-2026-113338"
kind: "vulnerability"
aliases: ["CVE-2026-113338"]
title: "Chrome: use-after-free in Turbolev lets a web page run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "google chrome", "fixed": ["156.0.8078.47"], "affected": "< 156.0.8078.47", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browser", "chrome", "desktop", "managed-browsers", "runtime"]
not_affected_if: ["already-on-156.0.8078.47-or-later"]
published_at: "2026-10-20T22:19:28+00:00"
first_seen_at: "2026-10-23T21:57:24+00:00"
updated_at: "2026-10-23T22:34:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113338", "first_seen_at": "2026-10-23T21:57:24+00:00"}]
---

# Chrome: use-after-free in Turbolev lets a web page run code

A memory bug in Turbolev, Chrome's JavaScript engine component, lets a remote attacker run arbitrary code inside the browser sandbox by serving a crafted HTML page. Visiting the malicious page is enough to trigger it, and the sandbox is still in place, so the attacker does not get full system control from this alone.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:google chrome affected < 156.0.8078.47 fixed 156.0.8078.47

## How to check

Run chrome://version in the browser and compare the Chrome version to 156.0.8078.47.
On managed fleets, query the installed Chrome version with your MDM or endpoint tool.

## Fix

Update Google Chrome to 156.0.8078.47 or later and restart the browser.

## Timeline

- 2026-10-23T21:57:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113338

## From the sources

Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_