Loading vulnerability…
Sandboxed code execution in Google Chrome Accessibility
CVE-2026-113271 is a use-after-free vulnerability in the Accessibility component of Google Chrome before version 156.0.8078.47. A remote attacker can trigger the vulnerability through a crafted HTML page to execute arbitrary code within the browser sandbox. Chromium classifies the vulnerability as Critical. The underlying Chromium flaw also affects Microsoft Edge. The specific vulnerable function and object-lifetime failure are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the browser sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the compromised process. The vulnerability has a reported CVSS v3.1 score of 8.8. Sandbox escape, host-level code execution, and full device compromise are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround or compensating control is documented.
Patch, then assume compromise.
Update Google Chrome to version 156.0.8078.47 or later on Windows and Linux, and 156.0.8078.48 or later on macOS. Restart Chrome to activate the update; administrators can enforce restarts using Chrome Enterprise policies. Update affected Chainguard Chromium packages to 156.0.8078.47-r0 or later and Echo Chromium packages to 156.0.8078.47 or later. Update Chromium-based Microsoft Edge to the latest available fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.