External risk intelligence

Use After Free in V8 Allows Sandbox Escape in Chrome

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113222

The vulnerability exists in a web browser client. While browser-based attacks are delivered via the internet, the browser itself is a client-side application running on an endpoint. It is not an internet-facing server, gateway, or edge service that is public-facing by design, making widespread, unprompted public internet exposure unlikely in the context of infrastructure surface area.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Google Chrome, identified as CVE-2026-113222. The issue, a use-after-free flaw within the V8 JavaScript engine, could allow a remote attacker to execute malicious code on a user's system by directing them to a compromised webpage. While the severity is high, the primary concern for leadership is determining if this specific vulnerability impacts any business-owned systems or is relevant to your organization's operational context.

Malicious websites could run unauthorized code.
It affects widely used web browsing technology.
Confirm relevance and potential exposure to your environment.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website. This website would then interact with a vulnerable part of the browser's JavaScript engine, potentially allowing the attacker to execute code on the user's system.

Requires user interaction with a malicious site.
Triggered by a use-after-free vulnerability.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in V8 within Google Chrome could allow an attacker to execute arbitrary code outside the sandbox. This could occur when a user visits a specially crafted HTML page, potentially impacting the confidentiality, integrity, and availability of the user's session and system when supported by the advisory.

Arbitrary code execution on user endpoints.
Visiting a malicious HTML page.
Compromised user data and system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in V8, present in Google Chrome, could allow attackers to execute code remotely. Real-world ownership typically falls to platform teams responsible for managing browser deployments and security teams who oversee vulnerability management and endpoint security. The first practical step is for platform owners to identify all Chrome installations, determine their reachability, and assess business criticality to prioritize remediation efforts.

Platform owners must identify affected systems.
Verify exposure and business criticality of installations.
Coordinate controlled updates or risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and the V8 engine?

Google Chrome is a widely used web browser. The V8 engine is a core component within Chrome that processes and executes JavaScript, the language that powers interactive elements on most modern websites. It essentially acts as the browser's brain for web code.

What does use-after-free mean for CVE-2026-113222?

This is a memory management error categorized as CWE-416. It happens when software continues to use a memory location after it has been cleared or deleted. In this CVE, an attacker can manipulate this confusion to force the browser to run unauthorized instructions, potentially bypassing the security sandbox designed to isolate web content from your computer's operating system.

How is this vulnerability triggered?

An attacker must entice a user to visit a specifically crafted HTML page designed to exploit the memory flaw. Simply having the browser installed is not enough to trigger the bug. If a user does not navigate to a malicious site, the vulnerability remains dormant.

Do I need to worry about public internet exposure?

According to Halo Surface Signal, this is unlikely. Because this flaw resides in a client-side web browser rather than an internet-facing server or edge service, it does not present a typical public-facing infrastructure risk. The primary concern is protecting individual endpoints where users actively browse the web.

What is the first step to address this risk?

Platform teams should begin by cataloging all Google Chrome installations across the organization to understand the total footprint. Once the inventory is clear, teams can prioritize updates to version 156.0.8078.47 or later, which resolves the flaw, ensuring that endpoints are no longer running the vulnerable code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.