Description
Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote system access restriction bypass via Chrome DevTools
Action: Update Browser
AI Analysis

Impact

The vulnerability is a race condition in the DevTools component of Google Chrome, identified as CWE-367. A crafted HTML page can trick a user into opening DevTools, enabling a remote attacker to bypass system access restrictions and potentially leak sensitive data from the sandbox. This flaw does not provide arbitrary code execution, but it grants the attacker the ability to read data that should remain isolated within the browser environment.

Affected Systems

All Google Chrome releases before 156.0.8078.47 are affected.

Risk and Exploitability

EPSS data shows a score of <1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV, so no exploitation has been observed to date. The CVE, with a CVSS score of 6.5, indicates medium severity, so the risk is moderate. The likely attack vector is remote via a crafted HTML page that activates DevTools; an attacker needs only to trick the user into opening a malicious page.

Generated by OpenCVE AI on November 4, 2026 at 06:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 156.0.8078.47 or newer
  • Disable or restrict DevTools access for users handling sensitive data
  • Educate users to avoid opening untrusted web pages that may activate DevTools

Generated by OpenCVE AI on November 4, 2026 at 06:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome DevTools Enables Remote Access Restriction Bypass

Wed, 04 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Title Chrome DevTools Memory Corruption Allows Sandbox Memory Leaks

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-367

Thu, 22 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Chrome DevTools Memory Corruption Allows Sandbox Memory Leaks

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:21:15.018Z

Reserved: 2026-10-19T22:52:03.202Z

Link: CVE-2026-113038

cve-icon Vulnrichment

Updated: 2026-10-21T15:09:30.603Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:18:54.887

Modified: 2026-11-03T22:18:19.197

Link: CVE-2026-113038

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T06:15:12Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition