Brief Summary: Google Chrome CVE-2026-119263 GarbageCollection Memory Corruption with Potential Sandbox Escape

Introduction

Google's October 29, 2026 Stable channel update for Chrome closed a memory corruption flaw in the browser's GarbageCollection component. According to the official description, the flaw could let a remote attacker execute arbitrary code outside the sandbox using a crafted HTML page. With Chrome at 68.79% of worldwide browser usage in October 2026 (Statcounter), and the same Chromium codebase sitting underneath Edge, Opera, Vivaldi and headless automation images, the practical question for most teams is less whether they run affected code and more where the unpatched builds are.

This post is a short review of what the public record establishes about CVE-2026-119263, what remains undisclosed, and how to find and fix exposed installations. Our information is current as of November 3, 2026.

Technical information

What the record says

The authoritative description reads: memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium rates it High. The NVD page displays a CVSS 3.1 score of 9.6 (Critical), supplied by CISA ADP. NIST has not published its own assessment. These are two different assessments from two different parties, and each should be cited with its attribution rather than merged into a single vendor score.

The weakness is classified as CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer.

Root cause: what is and is not known

The CWE mapping tells us the bug class, not the mechanism. It does not identify the allocation error, the corrupted object, or the primitive an attacker would gain. The upstream Chromium issue, 575143870, is marked "Permissions Required" on NVD and returns no public content. Chromium's standard practice is to keep security bugs restricted until roughly 14 weeks after the fix ships, so that users can update before the change can be studied.

As a result, nobody outside Google can currently confirm the root cause, the affected function, or the exact code that changed. We have deliberately not included code snippets or a reconstructed corruption sequence, because none are public. Treat any claimed commit for this CVE as unverified until it can be matched to issue 575143870.

Severity scoring

The recorded vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Per the FIRST CVSS v3.1 specification, the Base Score reflects intrinsic characteristics of the vulnerability; exploit code availability is a Temporal concern. A 9.6 therefore describes potential severity. It says nothing about observed attacks or whether working exploit code exists.

Why "outside the sandbox" matters

Chromium's sandbox design is built on process separation and least privilege. The browser process acts as a privileged broker, while renderers normally run as sandboxed targets whose code is treated as potentially malicious. A bug whose stated consequence is execution outside that boundary is serious because it removes the containment layer that normally limits what a compromised renderer can do. The changed scope (S:C) in the vector reflects that boundary crossing. The sandbox documentation explains why this matters in general. It does not describe the mechanism used by this particular CVE.

Attack flow, based on the public record

The disclosed scenario supports the following outline, and nothing more specific:

1. An attacker prepares a crafted HTML page.
2. The page is delivered over the network to a user running Chrome earlier than 156.0.8078.79. The vector records required user interaction, but the precise interaction (for example, what the user must do beyond loading content) is not specified.
3. Processing the page triggers memory corruption in the GarbageCollection component.
4. The potential outcome is arbitrary code execution outside the sandbox, with high impact to confidentiality, integrity and availability.

The accessible disclosure does not state whether a single bug is sufficient or whether an attacker would need to chain it with another vulnerability, and it does not describe any delivery campaign.

Exploitation status

No reviewed source confirms exploitation. Tenable states that no known exploits are available, and TheHackerWire reports no confirmed public exploit or detected public proof of concept. The official CISA KEV feed, version 2026.10.30 released October 30, 2026, does not contain this CVE, though that reflects only that dated snapshot. OffSeq's Threat Radar likewise reports no Nuclei template, no Metasploit or Exploit DB entry and no KEV listing as of early November 2026.

CIRCL Vulnerability Lookup shows two sightings, which by themselves do not establish exploitation. TheHackerWire displays an EPSS estimate of 0.27% for exploitation in the next 30 days, without a calculation date. No reviewed source names a threat actor, victim, campaign or infrastructure tied to this CVE.

Patch information

The fixing release

Google fixed CVE-2026-119263 in the Chrome 156.0.8078.79 stable release on October 29, 2026. The fix ships in the Stable and Extended Stable channel update to:

• 156.0.8078.79/.80 for Windows and Mac
• 156.0.8078.79 for Linux

Google's "Stable Channel Update for Desktop" post announced the release, and NVD tags it as the vendor advisory and release notes. NVD's configuration data marks the vulnerable range as:

cpe:2.3:a:google:chrome:*  up to (excluding) 156.0.8078.79

That makes 156.0.8078.79 the first build containing the fix. Gentoo's automated tracking bug (#985241) mirrors the release data (Linux 156.0.8078.79, released Thursday, October 29, 2026) and lists "CVE-2026-119263: Memory corruption in GarbageCollection" as one of 21 CVEs fixed in that build. HKCERT's bulletin gives the same fixed versions for each platform.

No public diff yet

Because issue 575143870 is still restricted, there is no public source-level diff to inspect. The Gerrit change or changes that fixed the GarbageCollection component will become traceable once the issue opens.

Chrome fixes ship as whole binary releases. This one arrives together with fixes for 20 other CVEs in the same build, including bugs in Frames, Skia, V8, Dawn and Quota. The GC fix cannot be applied on its own. The only way to obtain it is to run 156.0.8078.79 or later.

Downstream packaging (Debian)

The Debian security tracker shows how the upstream fix reaches rebuilt Chromium packages:

The forky row shows that a 156.x build earlier than .79 does not contain the fix, so the exact build number matters, not the milestone. The bookworm row carries the same upstream version but is still marked vulnerable, and the tracker does not explain why. Bookworm users should check Debian's status directly rather than assume a matching version string means they are fixed.

Gentoo has added the Google Chrome 156.0.8078.79 ebuild in commit 0c32af148e5b23e0fe0214639a47b9b554cffc98 (an automated ebuild bump). Its tracking bug also lists other Chromium-based browsers as affected: Edge, Opera, Opera GX, Vivaldi and Chromium itself. Each of those vendors ships the fix only when it rebases onto a Chromium build that includes it.

Completing the update on endpoints

Google's desktop procedure is: open Chrome, open the menu at the upper right, select Help, then About Google Chrome, and select Relaunch when offered. The update applies only when Chrome restarts. Ordinary tabs and windows reopen after the restart; Incognito windows do not.

For managed fleets, Google recommends automatic updates over manual ones and provides relaunch controls. Under Relaunch recommended, users can dismiss the notification and keep running the old version. Under Relaunch required, Chrome shows recurring messages requiring a relaunch within the configured period. The relevant policies are RelaunchNotification, RelaunchNotificationPeriod and RelaunchWindow. To verify configuration, open chrome://policy, select Reload policies, and confirm the policies show Status OK with the intended values. This confirms the policy configuration only. It does not confirm that a given endpoint has completed its update.

Detection methods

All publicly available detection options for CVE-2026-119263 find vulnerable installations, not exploitation attempts. None of the sources we reviewed offer a signature, IoC set, YARA, Sigma, Snort or Suricata rule, or Nuclei template. With issue 575143870 restricted, defenders lack the technical detail needed to write content-level signatures for the crafted HTML trigger.

1. The version boundary

Every check comes down to comparing the installed version against 156.0.8078.79. Any Chrome build below that is exposed. On Windows and Mac, a host may legitimately report either .79 or .80, and both are fixed. Inventory tools, EDR software catalogs and scanners can all apply this comparison.

2. Windows: Tenable Nessus plugin 373883

Plugin 373883, Google Chrome < 156.0.8078.79 Multiple Vulnerabilities (file google_chrome_156_0_8078_79.nasl), is a local, authenticated Windows check. It depends on the installed_sw/Google Chrome KB item and reports CVE-2026-119263 among about 20 CVEs. Tenable states the plugin "has not tested for these issues but has instead relied only on the application's self-reported version number." A finding means the host is exposed, not that it was attacked. Because it is a local check, you need credentialed scans or a Nessus Agent. An unauthenticated network scan will not see browser versions.

3. Linux distribution packages: Tenable Nessus plugin 374237

On Linux, Chromium usually comes from the distribution, so checks must follow distro package versions rather than Google's. Plugin 374237 (unpatched_CVE_2026_119263.nasl, Linux Distros Unpatched Vulnerability) is a local Unix check that flags chromium packages on Debian 12, 13 and 14 CPEs. Tenable notes it "relies on the presence of the package as reported by the vendor." It requires Host/local_checks_enabled and the global_settings/vendor_unpatched setting, so findings appear only if your scan policy reports vendor-unpatched issues.

Use the Debian Security Tracker as the reference for what counts as fixed (see the table above). Do not assume an upstream .79 version string means a Debian host is clean. Check its suite against the tracker.

4. Rapid7 InsightVM and Nexpose

Rapid7's vulnerability database lists CVE-2026-119263 as Covered by Rapid7 for Google Chrome, added October 30, 2026. A normal authenticated scan will surface exposed endpoints, and the solution maps to upgrading Chrome.

5. Containers and CI pipelines

Headless Chromium is easy to miss because it runs in build images, PDF renderers and scraping or automation services rather than on user desktops. A public example from the Onyx project shows how this gets caught. An automated audit workflow opened an issue against one of the project's sandbox audit images, flagging chromium (Debian 13) at installed version 156.0.8078.73-1~deb13u1 under the OSV advisory DEBIAN-CVE-2026-119263. Any image or SBOM scanner that consumes OSV or distro advisory feeds can catch this in CI, so include Chromium base layers and headless browser images in scan scope.

Limits of these checks

Version and package comparisons cannot tell you whether a host was compromised. Hunting beyond patch status falls back to general post-exploitation monitoring of browser processes, such as unexpected renderer crashes, unusual child processes or unusual network activity from Chrome. No published guidance ties any specific pattern to this CVE, so such hunts need tuning for your own environment. For prioritization, focus on unmanaged Chrome installs, hosts where automatic updates are blocked or delayed, and Linux or container Chromium packages that lag behind Google's fixed release.

Affected systems and versions

Snyk tracks the upstream Chromium package and likewise recommends 156.0.8078.79 or higher. Gentoo's tracking bug lists Edge, Opera, Opera GX, Vivaldi and Chromium as affected. Each is fixed only once its vendor ships a build rebased onto a fixed Chromium release. The shared codebase does not by itself establish a specific fixed version for each derivative, so consult each vendor's own release notes.

The vulnerable configuration is a browser at an affected build that renders attacker-supplied HTML. According to the public record, no special settings are required, and no configuration-based workaround has been disclosed.

Vendor security history

Google invests heavily in external research for Chrome. Its 2025 vulnerability rewards review reports $3,716,750 awarded to more than 100 Chrome reporters, and describes researchers finding holes and new escape classes in the V8 sandbox, which the team used to strengthen that boundary. The same review credits mitigations such as raw_ptr and object quarantining with reducing reported sandbox escapes involving complete exploit chains, while noting that researchers still demonstrated exploitation of IPC logic bugs.

A concrete precedent for exploited Chrome sandbox escapes is CVE-2025-2783. Kaspersky reported its use in Operation ForumTroll, a targeted campaign in which phishing emails posing as invitations to the Primakov Readings forum led to an attacker website. Targets included Russian media, educational institutions and government organizations. Kaspersky assessed the sophistication as suggestive of a state-sponsored group without naming one, and recommended Chrome 134.0.6998.177/.178 or later. CISA added that CVE to KEV on March 27, 2025.

That case shows what confirmed exploitation evidence looks like. It has no known connection to CVE-2026-119263, and none of its delivery methods, targets or suspected sponsorship should be attributed to this vulnerability.

References

Primary records and vendor advisories

• NVD: CVE-2026-119263
• CVE record (CVE Services API): CVE-2026-119263
• Chrome Releases: Stable Channel Update for Desktop (October 2026)
• Chromium issue 575143870 (restricted)
• HKCERT: Google Chrome Multiple Vulnerabilities bulletin

Distribution tracking

• Debian Security Tracker: CVE-2026-119263
• Gentoo Bugzilla #985241
• Snyk: Improper Restriction of Operations within the Bounds of a Memory Buffer in chromium

Detection

• Tenable Nessus plugin 373883: Google Chrome < 156.0.8078.79 Multiple Vulnerabilities
• Tenable Nessus plugin 374237: Linux Distros Unpatched Vulnerability
• Tenable CVE page: CVE-2026-119263
• Rapid7 Vulnerability Database: CVE-2026-119263
• Onyx project GitHub issue 17032 (container audit finding)
• OffSeq Threat Radar entry

Threat intelligence and secondary analysis

• TheHackerWire: CVE-2026-119263 analysis
• CIRCL Vulnerability Lookup: CVE-2026-119263
• SecurityOnline: Chrome 156 Security Update
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON feed
• CISA KEV entry for CVE-2025-2783
• Kaspersky: CVE-2025-2783 in Operation ForumTroll APT

Google and Chromium documentation

• Chromium Docs: Sandbox design
• Chrome for Developers: Chrome and Chromium
• Google Chrome Help: Update Google Chrome
• Chrome Enterprise Help: Manage Chrome updates
• Chrome Enterprise Help: Notify users to restart to apply pending updates
• Google Bug Hunters: Google VRPs in Review 2025
• Chrome Security 2026 Q2 Update

Scoring and market data

• FIRST: CVSS v3.1 Specification
• Statcounter: Browser Market Share Worldwide
• PiunikaWeb: Chrome desktop browser market share, October 2026