CVE-2026-113333
UnknownSummary
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.
Risk Assessment
A user visiting a malicious page may expose in-memory data, potentially leading to further exploitation.
Recommendation
Update Google Chrome to version 156.0.8078.47 or later.
Other vulnerabilities in Google Chrome Extensions
See all- CVE-2016-1648High
A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
- CVE-2026-12467High
Use after free in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-12457Medium
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who compromised the renderer process to bypass site isolation via a crafted HTML page.
- CVE-2026-12456Medium
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.
- CVE-2026-12445High
A use after free vulnerability in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker to exploit heap corruption via a malicious extension if a user installed it.
- CVE-2026-12017Low
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
- CVE-2026-8587High
A use after free vulnerability in Extensions in Google Chrome on Mac prior to version 148.0.7778.168 allows an attacker to execute arbitrary code via a malicious extension if a user installs it.
- CVE-2023-4366High
Use after free in Extensions in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
- CVE-2023-4078High
Inappropriate implementation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
- CVE-2023-4077High
Insufficient data validation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
Original NVD description (English source)
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS