Loading vulnerability…
Memory Corruption in Google Chrome Accessibility
CVE-2026-113279 is a memory corruption vulnerability in Google Chrome's Accessibility component affecting versions before 156.0.8078.47. A remote attacker can potentially trigger arbitrary code execution within the browser sandbox by causing the browser to process a crafted HTML page. Chromium classifies the vulnerability as Critical. Chromium-based Microsoft Edge is also affected. The specific vulnerable function and memory corruption mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of data and execution within the affected browser sandbox. Arbitrary code execution is potentially possible, but sandbox escape and compromise of the underlying operating system are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. Disabling Accessibility has not been established as an effective mitigation.
Patch, then assume compromise.
Upgrade Google Chrome to 156.0.8078.47 or later on Windows and Linux, and 156.0.8078.48 or later on macOS. Restart the browser to activate the update; enterprise administrators can enforce required restarts through Chrome Enterprise policies. Update affected Chromium packages to the distribution's fixed release; the identified Chainguard fix is 156.0.8078.47-r0 or later. Update Chromium-based Microsoft Edge to the latest security-patched version and verify that the update is installed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.