Description
Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

Memory corruption in Chrome's HID component prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This flaw enables code execution beyond the browser sandbox and poses a serious compromise risk.

Affected Systems

The flaw affects Google Chrome releases prior to 156.0.8078.47. All Chrome users running versions 156.0.8078.46 or earlier are susceptible. The update referenced in the Chrome release notes resolves the vulnerability.

Risk and Exploitability

The CVSS base score of 8.8 signals a high severity. The EPSS score is <1%, indicating a low likelihood of exploitation, and it is not in CISA KEV catalog. The likely attack vector is a remote attacker delivering a crafted HTML page. Successful exploitation would allow code execution outside the browser sandbox, potentially leading to full system compromise.

Generated by OpenCVE AI on November 4, 2026 at 11:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to Chrome version 156.0.8078.47 or later.
  • Use enterprise deployment tools or policies to push the update across all managed systems.
  • Enable Chrome's auto‑update feature and subscribe to Google security advisories.

Generated by OpenCVE AI on November 4, 2026 at 11:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 12:15:00 +0000

Type Values Removed Values Added
Title Memory Corruption in Chrome HID Allows Remote Code Execution Inside Sandbox

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Thu, 22 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Title Memory Corruption in Chrome HID Allows Remote Code Execution Inside Sandbox

Wed, 21 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:40.996Z

Reserved: 2026-10-19T22:49:07.301Z

Link: CVE-2026-113003

cve-icon Vulnrichment

Updated: 2026-10-20T23:15:49.600Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:18:50.773

Modified: 2026-11-03T22:17:49.980

Link: CVE-2026-113003

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T12:00:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer