External risk intelligence

Google Chrome PolicyContainer Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113126

This vulnerability affects a client-side web browser. While it requires the user to load a crafted HTML page, the vulnerability itself is tied to the local execution context of the browser application on a user's device, not a public-facing service, gateway, or network infrastructure that would be reachable or exploitable as a standalone internet-facing attack surface.

Memory Corruption

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory corruption vulnerability in Google Chrome's PolicyContainer could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a malicious webpage. This means that if a user accesses a compromised site, their browser could be manipulated to run unauthorized code, bypassing security protections.

Browser flaw could allow code execution.
User interaction is required for exploitation.
Confirm if Chrome users are potentially exposed.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website, which hosts a specially crafted HTML page. This page would then interact with a vulnerable component within the Chrome browser, potentially allowing the attacker to execute code outside the browser's secure sandbox.

Requires user interaction with a malicious page.
Crafted HTML triggers memory corruption.
Risk of code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit this vulnerability by tricking a user into visiting a malicious web page, potentially leading to the execution of arbitrary code on the user's system. This could affect the confidentiality, integrity, and availability of the user's device.

User's device and data.
Visiting a malicious HTML page.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's PolicyContainer could allow for arbitrary code execution outside the sandbox. Identifying affected systems and understanding their business criticality is the crucial first step, followed by confirming ownership and planning remediation based on risk assessment.

Own the issue: Application owners and security teams.
Verify first: System reachability and business criticality.
Action: Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's PolicyContainer?

PolicyContainer is a internal component within the Google Chrome browser responsible for managing and enforcing security policies. It helps govern how different web pages interact with browser resources. This vulnerability concerns how that component handles memory, which is a fundamental part of the browser's architecture for maintaining stability and security when processing web content.

What does memory corruption mean in CVE-2026-113126?

This vulnerability is classified as CWE-119, which refers to improper restriction of operations within the bounds of a memory buffer. In simple terms, the software fails to safely manage the data it receives. By sending specifically formatted data, an attacker can cause the program to behave unexpectedly, potentially allowing them to run unauthorized commands on the user's computer.

How is this vulnerability triggered?

An attacker must trick a user into visiting a malicious website that hosts a specially crafted HTML page. Simply having the browser installed does not trigger the flaw; it requires active interaction where the browser parses the malicious code. The bug is not triggered by standard, legitimate web traffic, but specifically by the malicious content designed to exploit the memory handling error.

Why does Halo Surface Signal categorize this as unlikely?

Halo Surface Signal notes that this is a client-side browser vulnerability, not a server-side flaw. Because it targets the local execution context on a user's device rather than a public-facing network service or gateway, it does not represent an internet-facing attack surface in the traditional sense. It requires user action to bridge the gap between the internet and the local system.

Do I need to patch my Chrome browser?

Yes. The first step is to confirm that your Chrome installations are updated to version 156.0.8078.47 or later. Since this vulnerability involves code execution outside the browser's sandbox, ensuring you are running the patched version is the primary way to protect your local system and data from this specific memory corruption issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.