Skip to main content
Apexward Pulse
Type Vulnerability

Google · Memory corruption

Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page

3 sourcesCVE-2026-110167CVE-2026-106269CVE-2026-110170+59 more

At a glance

Medium
7-day window, from the last update
Possible~0.7% estimated chance of attack in 30 days
Evidence-weighted, not popularity
Signal

~0.7% estimated chance of attack in 30 days. Exploitation not confirmed.

Why Medium

Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers.

Briefing

There is no written leader briefing for this story yet. These questions come from the facts we hold.

Questions to ask IT

  • Do we run Google Chrome and Microsoft Edge, and which versions?
  • If it is not yet patched, what mitigation is in place, and will the fix be done by 19 Nov?

Next steps

  1. Confirm whether this affects systems or suppliers in your estate

Summary

  • Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
  • CVE-2026-113303 has an estimated ~0.7% chance of attack in 30 days (52.4th percentile) as of 2026-11-10 — probability signal, not confirmed exploitation

Read the original reportMicrosoft Security Update Guide RSS(opens in a new tab)

Products and services involved

Same event, different frames

Distinct often headline the same incident differently.

Pulse

Last checked 3 Nov · Next recheck 13 Nov 2026, 00:15 UK time

Story
12 Nov 2026, 00:05 UK time · 49m ago

Linked reporting from Chrome Releases (vendor psirt).

Review the new source against your estate and the next steps in the briefing.

Read source (Chrome Releases)
EscalationDe-escalationCritical / liveWhat these mean
Drag to pan · Ctrl / ⌘ + scroll or pinch to zoom6 events

2 quiet checks hidden.

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-106269

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-110167

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-110170

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-110917

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-113012

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-113020

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-113040

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-113095

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-113154

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-113161

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-113303