CVE-2026-113158

HighCVSS 8.8/10Last modified Nov 3, 2026

Description

Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
GoogleChrome>= 156.0.8078.47, < 156.0.8078.47

References

Timeline

Published
Oct 20, 2026
Last modified
Nov 3, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1131596.5Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering tCVE-2026-113168.8A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A spCVE-2026-1131608.8Out of bounds write in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbCVE-2026-1131618.8Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1131628.8Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via aCVE-2026-1131638.8Buffer overflow in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary coCVE-2026-1131648.8Race condition in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions CVE-2026-1131658.8Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renCVE-2026-1131668.8Improper input validation in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised theCVE-2026-1131678.8Observable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted CVE-2026-1131688.8Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass CVE-2026-1131699.6UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engi
CVE-2026-113158: High severity, CVSS 8.8 | Vulnix