Threat database

Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-112993 is a use-after-free vulnerability in the Input component of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the browser sandbox by crafting a malicious HTML page. The vulnerability is rated high severity with a CVSS score of 8.8.

Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A high-severity memory corruption vulnerability exists in the Paint component of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a specially crafted HTML page. The vulnerability has a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. Google has released an update to address this issue.

A memory corruption vulnerability exists in the PDF component of Google Chrome prior to version 156.0.8078.47. This flaw could allow a remote attacker to potentially exploit the issue via a crafted HTML page. The vulnerability is rated with high severity by Chromium security. A stable channel update addressing this issue has been released by Google.

A use-after-free vulnerability exists in the Turbolev component of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.

Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

A memory corruption vulnerability exists in the Canvas component of Google Chrome prior to version 156.0.8078.47. This flaw could allow a remote attacker to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8. Google has released an update to address this issue.

A use-after-free vulnerability exists in the WebRTC component of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.

Improper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)