Loading vulnerability…
Use-after-free in Google Chrome SiteIsolation
CVE-2026-113101 is a use-after-free vulnerability in the SiteIsolation component of Google Chrome before version 156.0.8078.47. A remote attacker can trigger the vulnerability through a crafted HTML page to execute arbitrary code within the browser sandbox. Chromium rates the vulnerability as High severity. The specific vulnerable function and memory-lifetime sequence are not disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the Chrome sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected sandboxed process. The vulnerability alone does not establish sandbox escape or full device compromise.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Administrators can use Chrome Enterprise policies to prompt or require browser restarts so that pending security updates take effect.
Patch, then assume compromise.
Upgrade Google Chrome to version 156.0.8078.47 or later on Windows and Linux, and 156.0.8078.48 or later on macOS. Update affected Chromium packages to the applicable vendor-fixed release. Restart the browser to activate the update; administrators can enforce restarts through Chrome Enterprise policies.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.