Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-113193: Chrome <156 lets malicious page run code in sandbox
CVE-2026-113193 · published 15 days ago
Summary
Versions of Google Chrome and the Chromium browser that are older than version 156 can be tricked by a specially crafted web page into running unwanted code inside the browser's protection area. This could allow an attacker to take actions on the computer that the user did not intend. Update Chrome and Chromium to the latest version as soon as possible to close the gap.
What to do
- Update debian chromium to version 156.0.8078.47-1~deb12u1.
- Update debian chromium to version 156.0.8078.47-1~deb13u1.
- Update debian chromium to version 156.0.8078.47-1.
- Update google chrome to version 156.0.8078.47 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 156.0.8078.47-1~deb12u1 Fix: upgrade to 156.0.8078.47-1~deb12u1
|
| – | chrome | < 156.0.8078.47 | |
| Debian:13 | debian | chromium |
< 156.0.8078.47-1~deb13u1 Fix: upgrade to 156.0.8078.47-1~deb13u1
|
| Debian:14 | debian | chromium |
< 156.0.8078.47-1 Fix: upgrade to 156.0.8078.47-1
|
Original advisory text
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-119Buffer Overflow
CWE-843Type Confusion
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Track software like this
Free during beta