Every CVE Search/ Get API key

CVE-2026-113200

Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...

8.8 HighFix available

Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.37%Unchanged since Oct 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2026-113200
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-908
Updated
2026-11-03
EUVDEUVD-2026-105673 8.8

Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Record
EUVD-2026-105673
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-xjrh-3fv4-h5fw 8.8

Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...

Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Record
GHSA-xjrh-3fv4-h5fw
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416, CWE-908
Updated
2026-11-04
NVD 8.8

Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Record
CVE-2026-113200
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-908
Updated
2026-11-04
OSVDEBIAN-CVE-2026-113200 8.8

Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Record
DEBIAN-CVE-2026-113200
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-04
OSVALSA-2026:91580 No score

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325)
  • chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331)
  • chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304)
  • chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247)
  • chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293)
  • chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:91580
Updated
2026-11-04
OSVALSA-2026:91636 No score

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325)
  • chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331)
  • chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304)
  • chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247)
  • chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293)
  • chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:91636
Updated
2026-11-04
OSVopenSUSE-SU-2026:12234-1 No score

chromedriver-156.0.8078.47-1.1 on GA media

These are all security issues fixed in the chromedriver-156.0.8078.47-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12234-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22185-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Changes in chromium:

Chromium 156 (156.0.8078.47) promoted to stable (boo#1286350):

  • CVE-2026-113341: Memory corruption in Skia
  • CVE-2026-113279: Memory corruption in Accessibility
  • CVE-2026-113072: Memory corruption in CSS
  • CVE-2026-113280: Memory corruption in Paint
  • CVE-2026-113271: Use after free in Accessibility
  • CVE-2026-113303: Memory corruption in WebRTC
  • CVE-2026-113101: Use after free in SiteIsolation
  • CVE-2026-113097: Use after free in FileSystem
  • CVE-2026-113098: Memory corruption in CacheStorage
  • CVE-2026-113242: Memory corruption in ANGLE
  • CVE-2026-113058: Use after free in WebUI
  • CVE-2026-113082: Memory corruption in ANGLE
  • CVE-2026-113119: Use after free in Network
  • CVE-2026-113092: Use after free in Passwords
  • CVE-2026-113134: Memory corruption in ANGLE
  • CVE-2026-113339: Use after free in SVG
  • CVE-2026-113317: Memory corruption in Accessibility
  • CVE-2026-113193: Memory corruption in V8
  • CVE-2026-113117: Improper input validation in ANGLE
  • CVE-2026-113188: Memory corruption in GPU
  • CVE-2026-113104: Memory corruption in Frames
  • CVE-2026-113322: Memory corruption in Dawn
  • CVE-2026-113163: Use after free in WebGL
  • CVE-2026-113253: Use after free in Canvas
  • CVE-2026-113298: Use after free in Transactions Platform
  • CVE-2026-113315: Memory corruption in ANGLE
  • CVE-2026-113236: Use after free in Navigation
  • CVE-2026-113284: Memory corruption in XML
  • CVE-2026-113141: Use after free in Transactions Platform
  • CVE-2026-113316: Improper input validation in Views
  • CVE-2026-113234: Memory corruption in ANGLE
  • CVE-2026-113252: Improper input validation in ANGLE
  • CVE-2026-113305: Use after free in Privacy
  • CVE-2026-113044: Use after free in V8
  • CVE-2026-113135: Memory corruption in PictureInPicture
  • CVE-2026-113266: Memory corruption in ANGLE
  • CVE-2026-113273: Memory corruption in ANGLE
  • CVE-2026-113293: Use after free in ANGLE
  • CVE-2026-113225: Memory corruption in Browser
  • CVE-2026-113210: Use after free in ANGLE
  • CVE-2026-113285: Memory corruption in ANGLE
  • CVE-2026-113324: Use after free in GPU
  • CVE-2026-113334: Improper input validation in ANGLE
  • CVE-2026-113020: Improper input validation in Date
  • CVE-2026-113222: Use after free in V8
  • CVE-2026-113318: Memory corruption in ServiceWorker
  • CVE-2026-113310: Out of bounds read in Bluetooth
  • CVE-2026-113338: Use after free in Turbolev
  • CVE-2026-113093: Memory corruption in DisplayLocking
  • CVE-2026-113012: Improper input validation in GPU
  • CVE-2026-113175: Improper input validation in FileSystem
  • CVE-2026-113192: Memory corruption in V8
  • CVE-2026-113309: Out of bounds read in Media
  • CVE-2026-113295: Out of bounds read in ANGLE
  • CVE-2026-113217: Use after free in WebAppInstalls
  • CVE-2026-113040: Improper input validation in Proxy
  • CVE-2026-113161: Use after free in WebRTC
  • CVE-2026-113154: Memory corruption in Canvas
  • CVE-2026-113336: Memory corruption in Compositing
  • CVE-2026-113181: Use after free in Navigation
  • CVE-2026-113019: Use after free in Turbolev
  • CVE-2026-113095: Out of bounds read in Focus
  • CVE-2026-113160: Use after free in Turbolev
  • CVE-2026-113212: Memory corruption in PDF
  • CVE-2026-113000: Memory corruption in Paint
  • CVE-2026-113179: Use after free in Paint
  • CVE-2026-112993: Use after free in Input
  • CVE-2026-113055: Type confusion in FullScreen
  • CVE-2026-113068: Use after free in Input
  • CVE-2026-113320: Memory corruption in Navigation
  • CVE-2026-113231: Improper input validation in Extensions
  • CVE-2026-113174: Use after free in Extensions
  • CVE-2026-113022: Memory corruption in PDFium
  • CVE-2026-113079: Use after free in SiteIsolation
  • CVE-2026-113191: Use after free in Internals
  • CVE-2026-113250: Use after free in ANGLE
  • CVE-2026-113109: Memory corruption in API *…
Record
openSUSE-SU-2026:22185-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
webkit2gtk3
AlmaLinux:9
From an advisory covering 14 CVEs
 before 2.54.2-0.el9_8.1
2.54.2-0.el9_8.1
webkit2gtk3-devel
AlmaLinux:9
From an advisory covering 14 CVEs
 before 2.54.2-0.el9_8.1
2.54.2-0.el9_8.1
webkit2gtk3-jsc
AlmaLinux:9
From an advisory covering 14 CVEs
 before 2.54.2-0.el9_8.1
2.54.2-0.el9_8.1
webkit2gtk3-jsc-devel
AlmaLinux:9
From an advisory covering 14 CVEs
 before 2.54.2-0.el9_8.1
2.54.2-0.el9_8.1
webkit2gtk3
AlmaLinux:8
From an advisory covering 14 CVEs
 before 2.54.2-1.el8_10
2.54.2-1.el8_10
webkit2gtk3-devel
AlmaLinux:8
From an advisory covering 14 CVEs
 before 2.54.2-1.el8_10
2.54.2-1.el8_10
webkit2gtk3-jsc
AlmaLinux:8
From an advisory covering 14 CVEs
 before 2.54.2-1.el8_10
2.54.2-1.el8_10
webkit2gtk3-jsc-devel
AlmaLinux:8
From an advisory covering 14 CVEs
 before 2.54.2-1.el8_10
2.54.2-1.el8_10
chromium
Debian:12
 before 156.0.8078.47-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
156.0.8078.47-1~deb12u1
chromium
Debian:13
 before 156.0.8078.47-1~deb13u1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1~deb13u1
chromium
Debian:14
 before 156.0.8078.47-1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1
chromium
openSUSE:Tumbleweed
From an advisory covering 353 CVEs
 before 156.0.8078.47-1.1
156.0.8078.47-1.1
chromium
openSUSE:Leap 16.0
From an advisory covering 353 CVEs
 before 156.0.8078.47-bp160.1.1
156.0.8078.47-bp160.1.1

History

History
RecordedChangedSources
affected
affected, aliases, referencesGitHub Advisories, NVD, OSV
cwes, description, factsCVE List, EUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-113200 is a high vulnerability (CVSS 8.8) in Google Chrome, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in chromium 156.0.8078.47-1~deb12u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 694 versions, 183 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open