Description
Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use-after-free flaw was discovered in Chrome's Paint engine. The bug occurs when a crafted HTML page triggers the deallocation of memory that is still referenced by the browser, allowing a remote attacker to inject and run arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as critical. The weakness is a classic memory corruption bug identified as CWE‑416.

Affected Systems

All desktop installations of Google Chrome older than version 156.0.8078.47 are affected. Any Chrome build that includes the vulnerable Paint component and runs with normal user privileges is potentially exposed.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS score is < 1 %, suggesting that public exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by delivering a malicious web page containing the crafted HTML. Because the code executes inside the sandbox, the impact is confined to the browser process, but it still allows arbitrary code execution within that environment.

Generated by OpenCVE AI on November 4, 2026 at 14:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 156.0.8078.47 or later.
  • Configure automatic updates or corporate group‑policy settings to ensure all users run the latest Chrome release.
  • If an immediate upgrade is not possible, disable or restrict the Paint feature in Chrome or apply additional sandbox hardening through site‑settings or extensions.

Generated by OpenCVE AI on November 4, 2026 at 14:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Title Chrome Paint Memory Corruption Leading to Remote Code Execution via Crafted HTML

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Chrome Paint Memory Corruption Leading to Remote Code Execution via Crafted HTML

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:19.950Z

Reserved: 2026-10-19T23:14:58.865Z

Link: CVE-2026-113280

cve-icon Vulnrichment

Updated: 2026-10-20T23:34:11.990Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:21.897

Modified: 2026-11-03T22:19:04.573

Link: CVE-2026-113280

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T14:15:15Z

Weaknesses