External risk intelligence

Google Chrome Compositing Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113336

This vulnerability affects a client-side web browser. While it requires the user to load a crafted HTML page, the component itself (Compositing in a web browser) is client-side software. It is not a network-accessible service, gateway, or internet-facing infrastructure component, and therefore does not constitute a public-facing attack surface in the context of network deployment.

Memory Corruption

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory corruption vulnerability in Google Chrome's compositing component could allow a remote attacker to execute code outside the browser's security sandbox through a malicious web page. This is a critical issue that warrants review to determine its relevance to our environment.

Browser code execution flaw.
Attackers target user interaction.
Confirm if our users are exposed.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This page would contain specially crafted code designed to exploit a memory corruption flaw within Chrome's compositing feature. If successful, this could allow the attacker to break out of the browser's security sandbox and potentially run their own code on the user's device.

User visits a malicious web page.
Crafted HTML triggers compositing flaw.
Code execution outside browser sandbox.

Live Threat

Current exploitation, exposure, and threat context

A memory corruption vulnerability in Chrome's Compositing component could allow an attacker to execute arbitrary code outside the sandbox when a user visits a malicious HTML page.

Arbitrary code execution in the browser.
User visits a crafted HTML page.
Compromise of user's machine.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This vulnerability affects a client-side component within Google Chrome, specifically its compositing functionality. Identifying where this browser is deployed and used is the first step. Teams responsible for endpoint security, application support, and potentially end-user device management should collaborate to understand exposure and risk. Confirmation of business criticality for affected user groups and planning for user-centric remediation, such as controlled browser updates, are key next steps.

Ownership: Endpoint security and application support teams.
Verify first: User exposure and browser deployment.
Action: Plan controlled browser updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome Compositing?

Compositing is a core part of the browser engine responsible for assembling different layers of web content—such as text, images, and videos—into the final visual representation you see on your screen. It handles the complex task of layering and transforming elements efficiently, often using the device's graphics hardware. When this process fails to manage data correctly, it creates memory management issues that can impact the stability and security of the entire browser.

What does CVE-2026-113336 mean by memory corruption?

This CVE involves a weakness categorized as CWE-119, where the software writes data beyond the boundaries of its intended memory buffer. In plain terms, the browser's compositing component fails to safely handle data, allowing a malicious webpage to overwrite adjacent memory. By controlling this corrupted memory, an attacker could potentially force the browser to execute unauthorized instructions, bypassing the security sandbox designed to isolate web content from your computer.

How is this vulnerability triggered?

The trigger requires a user to interact with a specifically crafted HTML page designed to exploit the compositing flaw. Simply having the browser installed or running in the background does not trigger the bug; the malicious code must be actively processed by the browser's compositing engine. If a user does not navigate to a site hosting the crafted content, the vulnerability remains inactive.

Do I need to worry about this on my servers?

According to Halo Surface Signal, this is primarily a client-side risk. Because this vulnerability exists within a web browser—a tool meant for user interaction—it does not present the same risks as a network-accessible service or infrastructure gateway. It is not an internet-facing service that can be scanned or targeted remotely without user interaction. You should focus your attention on endpoint devices where employees actively browse the web.

What are the first steps to address this issue?

Start by identifying which systems in your environment are running affected versions of Google Chrome. Coordinate with your endpoint management and IT support teams to ensure those machines receive the latest security updates provided by the vendor. Since this is a browser-based risk, your remediation strategy should prioritize deploying these updates to end-user devices to ensure the compositing component is patched against known memory corruption flaws.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.