Loading vulnerability…
Critical CSS Memory Corruption in Google Chrome
CVE-2026-113072 is a critical memory corruption vulnerability in Google Chrome's CSS processing affecting versions before 156.0.8078.47. Processing a crafted HTML page could allow a remote attacker to execute arbitrary code outside the browser sandbox. The precise vulnerable function and memory corruption mechanism are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could permit arbitrary code execution outside Chrome's sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected browser process. A complete exploitation chain and full device compromise have not been established.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is established. Pending patch deployment, remote browser isolation for high-risk browsing can reduce endpoint exposure to malicious pages, but is not a substitute for updating.
Patch, then assume compromise.
Update Google Chrome to 156.0.8078.47 or later on Windows and Linux, and 156.0.8078.48 or later on macOS. Restart Chrome to activate the update and verify the running version across managed endpoints. For Chromium distribution packages, install the vendor-designated fixed package rather than relying solely on the upstream version number. If a package vendor provides no fix, migrate to a supported, patched browser package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.