Loading vulnerability…
Sandboxed Code Execution in Google Chrome Paint
CVE-2026-113280 is a memory-corruption vulnerability in the Paint component of Google Chrome before version 156.0.8078.47. A remote attacker can trigger the flaw through a crafted HTML page to execute arbitrary code within the browser sandbox. Chromium classifies the vulnerability as Critical. Chromium-based Microsoft Edge is also affected. The precise vulnerable function and memory-corruption mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the browser sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected sandboxed process. The vulnerability has a CVSS v3.1 base score of 8.8. A sandbox escape, host-level code execution, or full device compromise is not established.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary mitigation or workaround is documented.
Patch, then assume compromise.
Upgrade Google Chrome to version 156.0.8078.47 or later on Windows and Linux, and 156.0.8078.48 or later on macOS, then restart the browser to apply the update. For Chainguard Chromium packages, update Chromium and related packages to 156.0.8078.47-r0 or later; for Echo packages, update to 156.0.8078.47 or later. Update Chromium-based Microsoft Edge to the latest available fixed release. For distribution-managed Chromium installations, verify the vendor's CVE-specific package status; an upstream version match alone does not establish that a distribution package is fixed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.