External risk intelligence

Chrome Compositing Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113078

The vulnerability exists in the compositing engine of a web browser (Google Chrome). While the attack vector involves processing remote content, the surface is client-side software installed on individual endpoints, not an internet-facing service, gateway, or appliance that is independently exposed to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome's compositing feature could allow attackers to execute code outside the browser's security sandbox if a user visits a malicious web page. This is a medium-severity Chromium security issue that has been addressed in newer versions.

Bug lets code escape browser security.
Important for user data protection.
Confirm relevance and check exposure.

Attack Path

How an attacker could exploit the issue

Attackers can deliver a malicious HTML page to a user, which, when loaded in a vulnerable version of Google Chrome, could allow them to execute code outside the browser's sandbox. This could potentially lead to broader system compromise.

Remote attackers can initiate the attack.
A crafted HTML page triggers the vulnerability.
Risk of arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could potentially execute arbitrary code outside the sandbox when a user visits a malicious HTML page. This could impact the integrity and confidentiality of the user's system.

User system integrity and confidentiality.
Malicious HTML page execution.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Compositing component in Google Chrome is affected, suggesting that teams responsible for endpoint security and user-facing applications should lead the response. The first practical step involves identifying all systems running the affected browser version, assessing their exposure, and locating the accountable owner before planning remediation.

Identify affected endpoints and owners.
Verify browser reachability and criticality.
Coordinate browser updates with users.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Compositing component in Google Chrome?

Compositing is a core browser process responsible for taking various graphical elements—such as text, images, and animations—and assembling them into the final visual frame you see on your screen. It handles how different layers of a webpage interact visually before they are rendered by the graphics hardware.

What does CWE-20 mean for CVE-2026-113078?

CWE-20 refers to Improper Input Validation, which is the root cause of this vulnerability. It means the browser’s compositing engine fails to sufficiently verify or sanitize the data it receives from a webpage. Because this data is not properly checked, a maliciously crafted HTML page can trick the engine into performing unintended operations.

How does an attacker trigger this vulnerability?

An attacker triggers this by enticing a user to navigate to a specifically crafted malicious HTML page using an unpatched version of Chrome. Simply having the browser installed is not enough; the vulnerability does not trigger through background network traffic or passive system use, but requires the user to load the malicious content.

Is my browser at high risk based on Halo Surface Signal?

Halo Surface Signal classifies this as 'Very unlikely' to be an internet-facing gateway issue. Because this is client-side software on individual endpoints rather than a public-facing server, the risk is tied to user activity. While the code execution potential is high, the attack requires human interaction, making it less direct than a vulnerability in a public network service.

How should I address CVE-2026-113078?

The primary response is to ensure your Chrome installation is updated to version 156.0.8078.47 or later, where this issue is resolved. Start by auditing your endpoints to identify versions older than this, then coordinate with users or device management teams to apply the standard browser update, which effectively patches the compositing engine's input handling.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.