Every CVE Search/ Get API key

CVE-2026-113112

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...

8.8 HighFix available

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.25%Down 0.1 points since Oct 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2026-113112
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-367
Updated
2026-11-03
EUVDEUVD-2026-105549 8.8

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Record
EUVD-2026-105549
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-4h5v-g933-32m4 8.8

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Record
GHSA-4h5v-g933-32m4
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-367, CWE-416
Updated
2026-11-04
NVD 8.8

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2026-113112
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-367
Updated
2026-11-04
OSVDEBIAN-CVE-2026-113112 8.8

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Record
DEBIAN-CVE-2026-113112
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-04
OSVopenSUSE-SU-2026:12234-1 No score

chromedriver-156.0.8078.47-1.1 on GA media

These are all security issues fixed in the chromedriver-156.0.8078.47-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12234-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22185-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Changes in chromium:

Chromium 156 (156.0.8078.47) promoted to stable (boo#1286350):

  • CVE-2026-113341: Memory corruption in Skia
  • CVE-2026-113279: Memory corruption in Accessibility
  • CVE-2026-113072: Memory corruption in CSS
  • CVE-2026-113280: Memory corruption in Paint
  • CVE-2026-113271: Use after free in Accessibility
  • CVE-2026-113303: Memory corruption in WebRTC
  • CVE-2026-113101: Use after free in SiteIsolation
  • CVE-2026-113097: Use after free in FileSystem
  • CVE-2026-113098: Memory corruption in CacheStorage
  • CVE-2026-113242: Memory corruption in ANGLE
  • CVE-2026-113058: Use after free in WebUI
  • CVE-2026-113082: Memory corruption in ANGLE
  • CVE-2026-113119: Use after free in Network
  • CVE-2026-113092: Use after free in Passwords
  • CVE-2026-113134: Memory corruption in ANGLE
  • CVE-2026-113339: Use after free in SVG
  • CVE-2026-113317: Memory corruption in Accessibility
  • CVE-2026-113193: Memory corruption in V8
  • CVE-2026-113117: Improper input validation in ANGLE
  • CVE-2026-113188: Memory corruption in GPU
  • CVE-2026-113104: Memory corruption in Frames
  • CVE-2026-113322: Memory corruption in Dawn
  • CVE-2026-113163: Use after free in WebGL
  • CVE-2026-113253: Use after free in Canvas
  • CVE-2026-113298: Use after free in Transactions Platform
  • CVE-2026-113315: Memory corruption in ANGLE
  • CVE-2026-113236: Use after free in Navigation
  • CVE-2026-113284: Memory corruption in XML
  • CVE-2026-113141: Use after free in Transactions Platform
  • CVE-2026-113316: Improper input validation in Views
  • CVE-2026-113234: Memory corruption in ANGLE
  • CVE-2026-113252: Improper input validation in ANGLE
  • CVE-2026-113305: Use after free in Privacy
  • CVE-2026-113044: Use after free in V8
  • CVE-2026-113135: Memory corruption in PictureInPicture
  • CVE-2026-113266: Memory corruption in ANGLE
  • CVE-2026-113273: Memory corruption in ANGLE
  • CVE-2026-113293: Use after free in ANGLE
  • CVE-2026-113225: Memory corruption in Browser
  • CVE-2026-113210: Use after free in ANGLE
  • CVE-2026-113285: Memory corruption in ANGLE
  • CVE-2026-113324: Use after free in GPU
  • CVE-2026-113334: Improper input validation in ANGLE
  • CVE-2026-113020: Improper input validation in Date
  • CVE-2026-113222: Use after free in V8
  • CVE-2026-113318: Memory corruption in ServiceWorker
  • CVE-2026-113310: Out of bounds read in Bluetooth
  • CVE-2026-113338: Use after free in Turbolev
  • CVE-2026-113093: Memory corruption in DisplayLocking
  • CVE-2026-113012: Improper input validation in GPU
  • CVE-2026-113175: Improper input validation in FileSystem
  • CVE-2026-113192: Memory corruption in V8
  • CVE-2026-113309: Out of bounds read in Media
  • CVE-2026-113295: Out of bounds read in ANGLE
  • CVE-2026-113217: Use after free in WebAppInstalls
  • CVE-2026-113040: Improper input validation in Proxy
  • CVE-2026-113161: Use after free in WebRTC
  • CVE-2026-113154: Memory corruption in Canvas
  • CVE-2026-113336: Memory corruption in Compositing
  • CVE-2026-113181: Use after free in Navigation
  • CVE-2026-113019: Use after free in Turbolev
  • CVE-2026-113095: Out of bounds read in Focus
  • CVE-2026-113160: Use after free in Turbolev
  • CVE-2026-113212: Memory corruption in PDF
  • CVE-2026-113000: Memory corruption in Paint
  • CVE-2026-113179: Use after free in Paint
  • CVE-2026-112993: Use after free in Input
  • CVE-2026-113055: Type confusion in FullScreen
  • CVE-2026-113068: Use after free in Input
  • CVE-2026-113320: Memory corruption in Navigation
  • CVE-2026-113231: Improper input validation in Extensions
  • CVE-2026-113174: Use after free in Extensions
  • CVE-2026-113022: Memory corruption in PDFium
  • CVE-2026-113079: Use after free in SiteIsolation
  • CVE-2026-113191: Use after free in Internals
  • CVE-2026-113250: Use after free in ANGLE
  • CVE-2026-113109: Memory corruption in API *…
Record
openSUSE-SU-2026:22185-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
 before 156.0.8078.47-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
156.0.8078.47-1~deb12u1
chromium
Debian:13
 before 156.0.8078.47-1~deb13u1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1~deb13u1
chromium
Debian:14
 before 156.0.8078.47-1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1
chromium
openSUSE:Tumbleweed
From an advisory covering 353 CVEs
 before 156.0.8078.47-1.1
156.0.8078.47-1.1
chromium
openSUSE:Leap 16.0
From an advisory covering 353 CVEs
 before 156.0.8078.47-bp160.1.1
156.0.8078.47-bp160.1.1

History

History
RecordedChangedSources
affectedGitHub Advisories, NVD, OSV
cwes, description, factsCVE List, EUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-113112 is a high vulnerability (CVSS 8.8) in Google Chrome, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in chromium 156.0.8078.47-1~deb12u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 694 versions, 159 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open