Description
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free flaw in Chrome’s Navigation component affecting versions earlier than 156.0.8078.47. A maliciously crafted HTML page can trigger the flaw, allowing an attacker to execute arbitrary code outside the browser sandbox. This grants full system compromise to the attacker.

Affected Systems

Google Chrome, specifically all builds older than 156.0.8078.47, including stable channel releases prior to the 156.0.8078.47 update. Users of Chrome on any platform running those affected versions are at risk.

Risk and Exploitability

The CVSS score is 8.8, classifying the impact as high. The EPSS score is less than 1%, specifically 0.00443, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote, via a maliciously crafted web page that a user must visit or force the browser to load. Successful exploitation requires the user to load the vulnerable page, after which the attacker can potentially escape the sandbox and execute code on the host machine.

Generated by OpenCVE AI on November 4, 2026 at 13:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 156.0.8078.47 or later to obtain the fixed Navigation implementation.
  • If immediate upgrade is not feasible, consider restricting internet access for untrusted content or configuring enterprise policies to limit JavaScript execution for unknown sites.
  • Stay informed of future Chrome security releases by monitoring the Chrome Release blog and applying patches as soon as they become available.

Generated by OpenCVE AI on November 4, 2026 at 13:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
Title Chrome Navigation Use-After-Free Enables Remote Code Execution via Crafted HTML

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Chrome Navigation Use-After-Free Enables Remote Code Execution via Crafted HTML

Thu, 22 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:29.524Z

Reserved: 2026-10-19T23:06:42.495Z

Link: CVE-2026-113181

cve-icon Vulnrichment

Updated: 2026-10-20T23:25:54.606Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:10.870

Modified: 2026-11-03T22:18:46.303

Link: CVE-2026-113181

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T13:15:14Z

Weaknesses