Description
Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Update
AI Analysis

Impact

CacheStorage memory corruption in Google Chrome prior to 156.0.8078.47 is a type confusion bug that allows a remote attacker to exploit a crafted HTML page, potentially executing arbitrary code inside the sandbox. This vulnerability, identified as CWE-843, could result in code execution within the browser sandbox and data disclosure, and Chromium has rated the severity as high.

Affected Systems

The affected product is Google Chrome. Users of Chrome versions prior to 156.0.8078.47 are susceptible. No other Chrome releases are known to be vulnerable.

Risk and Exploitability

The likely attack vector is a malicious web page that a user opens in Chrome; no authentication or local privileges are required. While the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, the CVSS score of 6.5 indicates medium severity. The low EPSS score does not diminish the risk, and attackers could exploit the flaw by delivering a crafted web page over HTTP/HTTPS or any protocol that Chrome can render. Because the bug permits memory disclosure within the sandbox, a successful exploit could provide data leakage but may not elevate privileges outside the browser process without additional flaws.

Generated by OpenCVE AI on November 4, 2026 at 14:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 156.0.8078.47 or later, which includes the patch for the CacheStorage memory corruption.
  • If updating immediately is not possible, consider disabling CacheStorage via Chrome policies or command-line flags as a temporary mitigation.
  • Monitor Chrome update channels and security advisories for visibility into new exploits or additional mitigations.

Generated by OpenCVE AI on November 4, 2026 at 14:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Title CacheStorage Memory Corruption Allows Remote Memory Read in Chrome

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-843

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title CacheStorage Memory Corruption Allows Remote Memory Read in Chrome

Wed, 21 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:20.843Z

Reserved: 2026-10-19T22:58:08.644Z

Link: CVE-2026-113098

cve-icon Vulnrichment

Updated: 2026-10-21T15:15:01.471Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:01.600

Modified: 2026-11-03T22:18:31.070

Link: CVE-2026-113098

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T14:15:15Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')