Loading vulnerability…
Sandboxed Code Execution in Google Chrome WebRTC
CVE-2026-113303 is a memory corruption vulnerability in the WebRTC component of Google Chrome before version 156.0.8078.47. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as Critical. The precise vulnerable function and underlying memory-corruption mechanism are not confirmed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of data and execution within the affected browser sandbox. The vulnerability does not independently establish a sandbox escape or unrestricted host compromise; those outcomes would require an additional vulnerability or exploitation stage. Active exploitation is not established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is established. Preserve browser sandboxing and enforce site isolation as defense-in-depth measures; remote browser isolation can reduce endpoint exposure during high-risk browsing. These controls do not replace installation of the security update.
Patch, then assume compromise.
Update Chrome to version 156.0.8078.47 or later on Windows and Linux, and 156.0.8078.48 or later on macOS. Restart the browser to apply the update and verify the running version. Update affected Chainguard Chromium packages to 156.0.8078.47-r0 or later and affected Echo Chromium packages to 156.0.8078.47 or later. Administrators should enforce update deployment and browser relaunch deadlines.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.