Every CVE Search/ Get API key

CVE-2026-113341

Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote...

6.5 MediumFix available

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.46%Up 0.2 points since Oct 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Record
CVE-2026-113341
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-416
Updated
2026-11-03
EUVDEUVD-2026-105618 6.5

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Record
EUVD-2026-105618
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-j3wj-gcv7-gjjv 6.5

Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote...

Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Record
GHSA-j3wj-gcv7-gjjv
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-119, CWE-416
Updated
2026-11-04
NVD 6.5

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Record
CVE-2026-113341
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-416
Updated
2026-11-04
OSVDEBIAN-CVE-2026-113341 6.5

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Record
DEBIAN-CVE-2026-113341
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-04
OSVUBUNTU-CVE-2026-113341 6.5

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Record
UBUNTU-CVE-2026-113341
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-05
OSVopenSUSE-SU-2026:12234-1 No score

chromedriver-156.0.8078.47-1.1 on GA media

These are all security issues fixed in the chromedriver-156.0.8078.47-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12234-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22185-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Changes in chromium:

Chromium 156 (156.0.8078.47) promoted to stable (boo#1286350):

  • CVE-2026-113341: Memory corruption in Skia
  • CVE-2026-113279: Memory corruption in Accessibility
  • CVE-2026-113072: Memory corruption in CSS
  • CVE-2026-113280: Memory corruption in Paint
  • CVE-2026-113271: Use after free in Accessibility
  • CVE-2026-113303: Memory corruption in WebRTC
  • CVE-2026-113101: Use after free in SiteIsolation
  • CVE-2026-113097: Use after free in FileSystem
  • CVE-2026-113098: Memory corruption in CacheStorage
  • CVE-2026-113242: Memory corruption in ANGLE
  • CVE-2026-113058: Use after free in WebUI
  • CVE-2026-113082: Memory corruption in ANGLE
  • CVE-2026-113119: Use after free in Network
  • CVE-2026-113092: Use after free in Passwords
  • CVE-2026-113134: Memory corruption in ANGLE
  • CVE-2026-113339: Use after free in SVG
  • CVE-2026-113317: Memory corruption in Accessibility
  • CVE-2026-113193: Memory corruption in V8
  • CVE-2026-113117: Improper input validation in ANGLE
  • CVE-2026-113188: Memory corruption in GPU
  • CVE-2026-113104: Memory corruption in Frames
  • CVE-2026-113322: Memory corruption in Dawn
  • CVE-2026-113163: Use after free in WebGL
  • CVE-2026-113253: Use after free in Canvas
  • CVE-2026-113298: Use after free in Transactions Platform
  • CVE-2026-113315: Memory corruption in ANGLE
  • CVE-2026-113236: Use after free in Navigation
  • CVE-2026-113284: Memory corruption in XML
  • CVE-2026-113141: Use after free in Transactions Platform
  • CVE-2026-113316: Improper input validation in Views
  • CVE-2026-113234: Memory corruption in ANGLE
  • CVE-2026-113252: Improper input validation in ANGLE
  • CVE-2026-113305: Use after free in Privacy
  • CVE-2026-113044: Use after free in V8
  • CVE-2026-113135: Memory corruption in PictureInPicture
  • CVE-2026-113266: Memory corruption in ANGLE
  • CVE-2026-113273: Memory corruption in ANGLE
  • CVE-2026-113293: Use after free in ANGLE
  • CVE-2026-113225: Memory corruption in Browser
  • CVE-2026-113210: Use after free in ANGLE
  • CVE-2026-113285: Memory corruption in ANGLE
  • CVE-2026-113324: Use after free in GPU
  • CVE-2026-113334: Improper input validation in ANGLE
  • CVE-2026-113020: Improper input validation in Date
  • CVE-2026-113222: Use after free in V8
  • CVE-2026-113318: Memory corruption in ServiceWorker
  • CVE-2026-113310: Out of bounds read in Bluetooth
  • CVE-2026-113338: Use after free in Turbolev
  • CVE-2026-113093: Memory corruption in DisplayLocking
  • CVE-2026-113012: Improper input validation in GPU
  • CVE-2026-113175: Improper input validation in FileSystem
  • CVE-2026-113192: Memory corruption in V8
  • CVE-2026-113309: Out of bounds read in Media
  • CVE-2026-113295: Out of bounds read in ANGLE
  • CVE-2026-113217: Use after free in WebAppInstalls
  • CVE-2026-113040: Improper input validation in Proxy
  • CVE-2026-113161: Use after free in WebRTC
  • CVE-2026-113154: Memory corruption in Canvas
  • CVE-2026-113336: Memory corruption in Compositing
  • CVE-2026-113181: Use after free in Navigation
  • CVE-2026-113019: Use after free in Turbolev
  • CVE-2026-113095: Out of bounds read in Focus
  • CVE-2026-113160: Use after free in Turbolev
  • CVE-2026-113212: Memory corruption in PDF
  • CVE-2026-113000: Memory corruption in Paint
  • CVE-2026-113179: Use after free in Paint
  • CVE-2026-112993: Use after free in Input
  • CVE-2026-113055: Type confusion in FullScreen
  • CVE-2026-113068: Use after free in Input
  • CVE-2026-113320: Memory corruption in Navigation
  • CVE-2026-113231: Improper input validation in Extensions
  • CVE-2026-113174: Use after free in Extensions
  • CVE-2026-113022: Memory corruption in PDFium
  • CVE-2026-113079: Use after free in SiteIsolation
  • CVE-2026-113191: Use after free in Internals
  • CVE-2026-113250: Use after free in ANGLE
  • CVE-2026-113109: Memory corruption in API *…
Record
openSUSE-SU-2026:22185-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
 before 156.0.8078.47-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
156.0.8078.47-1~deb12u1
chromium
Debian:13
 before 156.0.8078.47-1~deb13u1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1~deb13u1
chromium
Debian:14
 before 156.0.8078.47-1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1
libskia
Debian:14
 All versions, plus listed versions
146.20260311+dfsg-1146.20260311+dfsg-2146.20260311+dfsg-3146.20260311+dfsg-4146.20260414~git.ef5f213+dfsg-1
Show 9 moreShow less
146.20260414~git.ef5f213+dfsg-2146.20260414~git.ef5f213+dfsg-3146.20260414~git.ef5f213+dfsg-4146.20260414~git.ef5f213+dfsg-5146.20260602~git.3476902+dfsg-1146.20260602~git.3476902+dfsg-2146.20260602~git.3476902+dfsg-3146.20260602~git.3476902+dfsg-4146.20260602~git.3476902+dfsg-5
 None known
libskia
Ubuntu:26.10
 All versions, plus listed versions
146.20260311+dfsg-4ubuntu1146.20260414~git.ef5f213+dfsg-5146.20260602~git.3476902+dfsg-2146.20260602~git.3476902+dfsg-4
 None known
libskia
Ubuntu:26.04:LTS
 All versions, plus listed versions
146.20260311+dfsg-4ubuntu1
 None known
chromium
openSUSE:Tumbleweed
From an advisory covering 353 CVEs
 before 156.0.8078.47-1.1
156.0.8078.47-1.1
chromium
openSUSE:Leap 16.0
From an advisory covering 353 CVEs
 before 156.0.8078.47-bp160.1.1
156.0.8078.47-bp160.1.1

History

History
RecordedChangedSources
affectedGitHub Advisories, NVD, OSV
cwes, description, factsCVE List, EUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-113341 is a medium vulnerability (CVSS 6.5) in Google Chrome, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in chromium 156.0.8078.47-1~deb12u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 694 versions, 161 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open