Description
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw in Chrome’s Actor component, present in versions before 156.0.8078.47, permits a remote attacker—typically by social engineering—to run arbitrary code inside the browser sandbox with a crafted HTML page. This memory‑corruption issue is classified as CWE‑416.

Affected Systems

Google Chrome versions prior to 156.0.8078.47 are affected. Users running any older stable channel builds that have not applied this update are at risk.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS score is less than 1 %, suggesting exploitation probability is very low but non‑zero, and the vulnerability is not listed in the CISA KEV catalog. The attacker can target vulnerable browsers via a crafted web page, so the risk remains serious despite the low exploitation likelihood.

Generated by OpenCVE AI on November 4, 2026 at 06:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 156.0.8078.47 or later.
  • Ensure automatic updates are enabled and promptly apply any new security releases.
  • Avoid enabling experimental features that could expose the browser to untrusted content; use safe browsing settings and avoid opening untrusted PDF/XPS files directly in Chrome.

Generated by OpenCVE AI on November 4, 2026 at 06:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Actor Allows Remote Code Execution

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Thu, 22 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Thu, 22 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Actor Allows Remote Code Execution

Wed, 21 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:58.482Z

Reserved: 2026-10-19T22:57:09.851Z

Link: CVE-2026-113087

cve-icon Vulnrichment

Updated: 2026-10-20T23:02:21.348Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:00.377

Modified: 2026-11-03T22:18:29.117

Link: CVE-2026-113087

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T06:15:12Z

Weaknesses