Every CVESearch/Get API key

CVE-2026-113333

Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...

6.5 MediumFix available

CVE-2026-113333 is a medium vulnerability (CVSS 6.5) in Google Chrome, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in chromium 156.0.8078.47-1~deb12u1.

What does this mean?
Severity
6.5 MediumCVSS 3.1, CVE List
Exploit chance
0.25%EPSS, 16th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
156.0.8078.47-1~deb12u1chromium +6 more

Description

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.25%Unchanged since Oct 21, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
before 156.0.8078.47-1~deb12u1, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
156.0.8078.47-1~deb12u1
chromium
Debian:13
before 156.0.8078.47-1~deb13u1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1~deb13u1
chromium
Debian:14
before 156.0.8078.47-1, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
156.0.8078.47-1
chromium
openSUSE:Tumbleweed
From an advisory covering 353 CVEs
before 156.0.8078.47-1.1
156.0.8078.47-1.1
chromium
openSUSE:Leap 16.0
From an advisory covering 353 CVEs
before 156.0.8078.47-bp160.1.1
156.0.8078.47-bp160.1.1
chromium
openSUSE:Leap 16.1
From an advisory covering 975 CVEs
before 157.0.8103.38-bp161.1.1
157.0.8103.38-bp161.1.1
gn
openSUSE:Leap 16.1
From an advisory covering 975 CVEs
before 0.20260928-bp161.1.1
0.20260928-bp161.1.1

What each source reports

CVE List Score used6.5

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

Record
CVE-2026-113333
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-367
Updated
2026-11-03
EUVDEUVD-2026-1055136.5

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

Record
EUVD-2026-105513
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-83qw-f9j4-jgxv6.5

Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...

Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Record
GHSA-83qw-f9j4-jgxv
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-119, CWE-367
Updated
2026-11-04
NVD6.5

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

Record
CVE-2026-113333
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-367
Updated
2026-11-04
OSVDEBIAN-CVE-2026-1133336.5

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

Record
DEBIAN-CVE-2026-113333
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-04
OSVopenSUSE-SU-2026:12234-1No score

chromedriver-156.0.8078.47-1.1 on GA media

These are all security issues fixed in the chromedriver-156.0.8078.47-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12234-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22185-1No score

Security update for chromium

This update for chromium fixes the following issues:

Changes in chromium:

Chromium 156 (156.0.8078.47) promoted to stable (boo#1286350):

  • CVE-2026-113341: Memory corruption in Skia
  • CVE-2026-113279: Memory corruption in Accessibility
  • CVE-2026-113072: Memory corruption in CSS
  • CVE-2026-113280: Memory corruption in Paint
  • CVE-2026-113271: Use after free in Accessibility
  • CVE-2026-113303: Memory corruption in WebRTC
  • CVE-2026-113101: Use after free in SiteIsolation
  • CVE-2026-113097: Use after free in FileSystem
  • CVE-2026-113098: Memory corruption in CacheStorage
  • CVE-2026-113242: Memory corruption in ANGLE
  • CVE-2026-113058: Use after free in WebUI
  • CVE-2026-113082: Memory corruption in ANGLE
  • CVE-2026-113119: Use after free in Network
  • CVE-2026-113092: Use after free in Passwords
  • CVE-2026-113134: Memory corruption in ANGLE
  • CVE-2026-113339: Use after free in SVG
  • CVE-2026-113317: Memory corruption in Accessibility
  • CVE-2026-113193: Memory corruption in V8
  • CVE-2026-113117: Improper input validation in ANGLE
  • CVE-2026-113188: Memory corruption in GPU
  • CVE-2026-113104: Memory corruption in Frames
  • CVE-2026-113322: Memory corruption in Dawn
  • CVE-2026-113163: Use after free in WebGL
  • CVE-2026-113253: Use after free in Canvas
  • CVE-2026-113298: Use after free in Transactions Platform
  • CVE-2026-113315: Memory corruption in ANGLE
  • CVE-2026-113236: Use after free in Navigation
  • CVE-2026-113284: Memory corruption in XML
  • CVE-2026-113141: Use after free in Transactions Platform
  • CVE-2026-113316: Improper input validation in Views
  • CVE-2026-113234: Memory corruption in ANGLE
  • CVE-2026-113252: Improper input validation in ANGLE
  • CVE-2026-113305: Use after free in Privacy
  • CVE-2026-113044: Use after free in V8
  • CVE-2026-113135: Memory corruption in PictureInPicture
  • CVE-2026-113266: Memory corruption in ANGLE
  • CVE-2026-113273: Memory corruption in ANGLE
  • CVE-2026-113293: Use after free in ANGLE
  • CVE-2026-113225: Memory corruption in Browser
  • CVE-2026-113210: Use after free in ANGLE
  • CVE-2026-113285: Memory corruption in ANGLE
  • CVE-2026-113324: Use after free in GPU
  • CVE-2026-113334: Improper input validation in ANGLE
  • CVE-2026-113020: Improper input validation in Date
  • CVE-2026-113222: Use after free in V8
  • CVE-2026-113318: Memory corruption in ServiceWorker
  • CVE-2026-113310: Out of bounds read in Bluetooth
  • CVE-2026-113338: Use after free in Turbolev
  • CVE-2026-113093: Memory corruption in DisplayLocking
  • CVE-2026-113012: Improper input validation in GPU
  • CVE-2026-113175: Improper input validation in FileSystem
  • CVE-2026-113192: Memory corruption in V8
  • CVE-2026-113309: Out of bounds read in Media
  • CVE-2026-113295: Out of bounds read in ANGLE
  • CVE-2026-113217: Use after free in WebAppInstalls
  • CVE-2026-113040: Improper input validation in Proxy
  • CVE-2026-113161: Use after free in WebRTC
  • CVE-2026-113154: Memory corruption in Canvas
  • CVE-2026-113336: Memory corruption in Compositing
  • CVE-2026-113181: Use after free in Navigation
  • CVE-2026-113019: Use after free in Turbolev
  • CVE-2026-113095: Out of bounds read in Focus
  • CVE-2026-113160: Use after free in Turbolev
  • CVE-2026-113212: Memory corruption in PDF
  • CVE-2026-113000: Memory corruption in Paint
  • CVE-2026-113179: Use after free in Paint
  • CVE-2026-112993: Use after free in Input
  • CVE-2026-113055: Type confusion in FullScreen
  • CVE-2026-113068: Use after free in Input
  • CVE-2026-113320: Memory corruption in Navigation
  • CVE-2026-113231: Improper input validation in Extensions
  • CVE-2026-113174: Use after free in Extensions
  • CVE-2026-113022: Memory corruption in PDFium
  • CVE-2026-113079: Use after free in SiteIsolation
  • CVE-2026-113191: Use after free in Internals
  • CVE-2026-113250: Use after free in ANGLE
  • CVE-2026-113109: Memory corruption in API *…
Record
openSUSE-SU-2026:22185-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22323-1No score

Security update for chromium, gn

This update for chromium, gn fixes the following issues:

Changes in chromium:

  • Chromium 157 (157.0.8103.38) promoted to stable (boo#1289268):
    • CVE-2026-121156: Buffer overflow in Dawn
    • CVE-2026-121229: Memory corruption in ANGLE
    • CVE-2026-121246: Use after free in WebGL
    • CVE-2026-121035: Use after free in Prerender
    • CVE-2026-121247: Buffer overflow in Dawn
    • CVE-2026-121203: Use after free in Geometry
    • CVE-2026-121126: Use after free in Core
    • CVE-2026-121107: Incorrect authorization in BackgroundFetch
    • CVE-2026-121197: Out of bounds read in ANGLE
    • CVE-2026-121112: Out of bounds read in Permissions
    • CVE-2026-121174: Missing authorization in BackgroundFetch
    • CVE-2026-121098: Improper state validation in GPU
    • CVE-2026-121074: Memory corruption in GPU
    • CVE-2026-121173: Uninitialized resource in WebGL
    • CVE-2026-121233: Type confusion in CacheStorage
    • CVE-2026-121140: Out of bounds read in Internals
    • CVE-2026-121095: Uninitialized resource in WebGL
    • CVE-2026-121071: Incorrect authorization in FileSystem
    • CVE-2026-121207: Uninitialized resource in Dawn
    • CVE-2026-121185: Use after free in PictureInPicture
    • CVE-2026-121166: Type confusion in PDFium
    • CVE-2026-121047: Buffer overflow in Media
    • CVE-2026-121124: Improper adherence to coding standards in XML
    • CVE-2026-121118: Use after free in SVG
    • CVE-2026-121188: Use after free in PerformanceAPIs
    • CVE-2026-121113: Buffer overflow in PDFium
    • CVE-2026-121082: Type confusion in V8
    • CVE-2026-121083: Use after free in Compositing
    • CVE-2026-121179: Use after free in PDFium
    • CVE-2026-121180: Buffer overflow in Media
    • CVE-2026-121181: Use after free in Editing
    • CVE-2026-121228: Type confusion in V8
    • CVE-2026-121080: Use after free in Codecs
    • CVE-2026-121044: Use after free in Layout
    • CVE-2026-121051: UI misrepresentation in iOSWeb
    • CVE-2026-121038: Information leak in Compositing
    • CVE-2026-121090: Improper privilege management in Navigation
    • CVE-2026-121052: Use after free in GPU
    • CVE-2026-121037: Out of bounds write in ANGLE
    • CVE-2026-121086: Buffer overflow in Skia
    • CVE-2026-121131: Use after free in Mobile
    • CVE-2026-121087: Improper input validation in Mobile
    • CVE-2026-121178: Use after free in Aura
    • CVE-2026-121100: Use after free in DOM
    • CVE-2026-121148: Use after free in ANGLE
    • CVE-2026-121089: Use after free in WebGPU
    • CVE-2026-121250: Use after free in Extensions
    • CVE-2026-121032: Out of bounds read in Skia
    • CVE-2026-121114: Use after free in TabStrip
    • CVE-2026-121127: Use after free in WebAudio
    • CVE-2026-121210: Type confusion in V8
    • CVE-2026-121057: Type confusion in V8
    • CVE-2026-121201: Use after free in Animation
    • CVE-2026-121084: Out of bounds read in Skia
    • CVE-2026-121094: Type confusion in V8
    • CVE-2026-121079: Race condition in V8
    • CVE-2026-121143: Uninitialized resource in GPU
    • CVE-2026-121097: Use after free in Printing
    • CVE-2026-121214: Use after free in Passwords
    • CVE-2026-121133: Incorrect reference resolution in Images
    • CVE-2026-121249: Buffer overflow in ANGLE
    • CVE-2026-121213: Uninitialized resource in Images
    • CVE-2026-121241: Use after free in Navigation
    • CVE-2026-121224: Security issue in Desktop
    • CVE-2026-121117: Use after free in Paint
    • CVE-2026-121123: Use after free in Canvas
    • CVE-2026-121182: Use after free in DOM
    • CVE-2026-121061: Use after free in Modularization
    • CVE-2026-121227: Uninitialized resource in Skia
    • CVE-2026-121226: Type confusion in V8
    • CVE-2026-121068: Type confusion in V8
    • CVE-2026-121137: Type confusion in DevTools
    • CVE-2026-121160: Out of bounds read in Skia
    • CVE-2026-121036: Use after free in CSS
    • CVE-2026-121104: Incorrect authorization in FileSystem
    • CVE-2026-121034: Use after free in Views
    • CVE-2026-121208: Out of bounds read in Media
    • CVE-2026-121129: Use after free in WebRTC
    • CVE-2026-121211: Use after free…
Record
openSUSE-SU-2026:22323-1
Updated
2026-11-14

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affectedGitHub Advisories, NVD, OSV
cwes, description, factsCVE List, EUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 694 versions, 789 references and the rest of 2 source descriptions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open