CVE-2026-113154: Memory corruption in Google Chrome

CVE-2026-113154 is a memory corruption vulnerability in the Canvas feature of Google Chrome versions before 156.0.8078.47. Exploitation involves a remote attacker crafting a malicious HTML page that triggers the flaw, potentially enabling arbitrary code execution inside the sandboxed environment of the browser. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Google has published a security update fixing this issue in Chrome version 156.0.8078.47.

Successful exploitation could allow remote code execution within the sandbox of Google Chrome, potentially compromising the confidentiality, integrity, and availability of the affected system. The attack requires user interaction (visiting a crafted HTML page) but does not require privileges or authentication.

Google has released an official fix in Chrome version 156.0.8078.47. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.