Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-113066: Chrome and Chromium can leak memory via malicious web page
CVE-2026-113066 · published 15 days ago
Summary
Versions of Google Chrome and the Chromium browser released before version 156.0.8078.47 may let a specially crafted web page read data from the browser’s memory. This could expose information that should be protected inside the browser’s sandbox. Updating the browsers to the latest version fixes the issue.
What to do
- Update debian chromium to version 156.0.8078.47-1~deb13u1.
- Update debian chromium to version 156.0.8078.47-1~deb12u1.
- Update debian chromium to version 156.0.8078.47-1.
- Update google chrome to version 156.0.8078.47 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 156.0.8078.47-1~deb12u1 Fix: upgrade to 156.0.8078.47-1~deb12u1
|
| – | chrome | < 156.0.8078.47 | |
| Debian:13 | debian | chromium |
< 156.0.8078.47-1~deb13u1 Fix: upgrade to 156.0.8078.47-1~deb13u1
|
| Debian:14 | debian | chromium |
< 156.0.8078.47-1 Fix: upgrade to 156.0.8078.47-1
|
Original advisory text
Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium securit...
Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-119Buffer Overflow
CWE-843Type Confusion
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Track software like this
Free during beta