External risk intelligence

Chrome PerformanceAPIs Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113056

This vulnerability exists within a web browser's client-side components. Exploitation requires a user to navigate to a crafted HTML page, meaning it is not a service that is inherently internet-facing or reachable without specific user interaction in a client-side environment.

Memory Corruption

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory corruption vulnerability has been identified in Google Chrome's PerformanceAPIs, potentially allowing remote attackers to execute code outside the sandbox through a malicious webpage. While rated as CRITICAL by CVSS, its practical impact is considered very unlikely due to the requirement for user interaction with a crafted HTML page.

Code flaw in browser performance tools.
Requires user to visit a bad website.
Confirm relevance and assess actual exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which then exploits a memory corruption flaw in Chrome's PerformanceAPIs. This could allow the attacker to execute their own code outside of the browser's security boundaries.

Attacker needs user to visit a malicious page.
Vulnerability triggered by crafted HTML.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

Memory corruption in Google Chrome's Performance APIs could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page. This impacts the user's browser environment.

User's browser environment.
Via a crafted HTML page.
Potential for arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining precise ownership requires understanding how Google Chrome is managed within your environment, as it could fall under endpoint security, application deployment, or IT support teams. The initial practical step is to identify all endpoints with the affected browser version, assess their business criticality and user exposure, and then coordinate with the accountable team for remediation planning during a planned maintenance window.

Identify Chrome deployment scope and reachability.
Confirm business criticality and user exposure.
Plan remediation with accountable team.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's PerformanceAPIs component?

PerformanceAPIs are a set of tools within Google Chrome that allow web developers to measure and analyze how a website loads and runs. These internal functions help optimize user experience by tracking timing and performance metrics. In this context, the browser relies on these APIs to process complex site data efficiently, but a flaw here means the mechanisms responsible for these speed calculations are currently unstable.

How does memory corruption work in CVE-2026-113056?

This vulnerability is classified as CWE-119, which refers to improper restriction of operations within the bounds of a memory buffer. Essentially, the software fails to properly handle data, allowing it to overwrite adjacent memory. In this CVE, that error allows an attacker to manipulate the browser's internal memory space, potentially bypassing the sandbox—the protective boundary that normally stops websites from touching your computer's core systems.

When does this vulnerability trigger?

The flaw triggers only when a user actively navigates to a specifically crafted, malicious HTML page that interacts with the compromised PerformanceAPIs. It does not trigger simply by having the browser installed, nor does it run automatically in the background. If a user does not visit the malicious site, the vulnerable code path remains dormant and cannot be weaponized by an attacker.

Is this CVE dangerous if my systems aren't internet-facing?

Halo Surface Signal notes that this vulnerability is very unlikely to pose a broad risk because it is a client-side issue, not a server-side service. Since exploitation requires human interaction to visit a harmful webpage, the traditional distinction between internet-facing and internal assets matters less than user behavior. The primary risk is confined to the individual browser session rather than network-level infrastructure.

Do I need to take immediate action for this Chrome bug?

The first step is to audit your environment to locate all endpoints running the affected version of Google Chrome. Once you have identified these assets, assess which users are at the highest risk based on their typical web browsing habits. Coordinate with your IT or endpoint management teams to schedule an update to the patched version of the browser during your next standard maintenance window to resolve the flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.