Brief Summary: Google Chrome Quota Memory Corruption (CVE-2026-119265) Allowing Sandboxed Code Execution

Introduction

A crafted HTML page could corrupt memory in Chrome's Quota component, the code that tracks and limits how much storage each web origin may consume, and potentially run attacker code inside the browser sandbox. Statcounter puts Chrome at 68.79% of worldwide browser usage in October 2026, so the fix in the October 29 Stable Channel update matters to nearly every managed fleet, even though no public evidence of exploitation exists today.

This post is a short review of what the public record supports for CVE-2026-119265:

• the vulnerable and fixed builds
• how the patch reached downstream packages
• how to find exposed hosts

We also note what remains unknown while the Chromium bug stays restricted.

Technical information

What the record states

Google supplied the CVE description: memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium rates it High.

NVD publishes a CVSS 3.1 base score of 8.8. That score comes from CISA ADP, and NIST has not published its own assessment. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which decodes as follows:

• Attack vector: Network (AV:N)
• Attack complexity: Low (AC:L)
• Privileges required: None (PR:N)
• User interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality, integrity, availability: High (C:H, I:H, A:H)

Two parts of that vector limit what the score implies:

• UI:R: remote reachability is not the same as exploitation without user action. A victim has to load attacker-controlled content.
• High impact ratings: these describe the assessed potential impact, not losses from any observed incident.

Root cause: what is known and what is not

Quota is the Chrome subsystem that accounts for per-origin storage and enforces limits for web storage APIs. NVD classifies the flaw as CWE-119, improper restriction of operations within the bounds of a memory buffer.

MITRE defines CWE-119 broadly as reading or writing outside a buffer's intended boundary. Its listed consequences include corruption, crashes, information disclosure and code execution. Those are general consequences of the weakness class, not demonstrated outcomes for this specific bug.

Chromium tracks the issue as 575201795. When we checked, that issue returned "Access is denied to this issue", and NVD tags the reference as Permissions Required. As a result, none of the following is public:

• the corrupted allocation
• the affected function or exact process
• the faulty bounds or lifetime calculation
• the fixing commit
• the steps needed to turn corruption into code execution

A more specific diagnosis, such as heap overflow versus use after free, is therefore not established. We do not reproduce any code here because no verified snippet exists in public sources.

The same release fixed a second Quota bug, CVE-2026-119266, a use after free tracked as issue 575202553. Fixing two memory safety bugs in one subsystem in a single release suggests Google hardened Quota more broadly this cycle. That is our inference, not a statement from Google.

The sandbox boundary

The disclosed outcome is code execution inside the sandbox, and the vector marks scope as Unchanged. The public description does not claim a sandbox escape or unrestricted compromise of the operating system.

That puts it in a different class from historical Chrome bugs such as CVE-2025-2783, which NVD explicitly describes as a sandbox escape. Describing CVE-2026-119265 as full host compromise would overstate what the evidence supports.

Attack flow

Based on the published description and Snyk's summary, the disclosed scenario is:

1. An attacker prepares a crafted HTML page that targets the vulnerable Quota code.
2. The attacker entices a user running Chrome earlier than 156.0.8078.79 to visit the page. This is the user interaction step reflected in UI:R.
3. The page causes Chrome to execute Quota code in a way that corrupts memory. The specific Quota operation and page contents have not been published.
4. The corruption could be turned into arbitrary code execution within the sandboxed context.
5. The attacker's capabilities remain bounded by the sandbox unless they hold an additional, separate escape. Nothing in this CVE supplies one.

No source we reviewed publishes the HTML, the triggering API sequence or a reproducible exploitation procedure.

Patch information

Google fixed CVE-2026-119265 in the Chrome 156 Stable and Extended Stable update. The release post is dated Thursday, October 29, 2026, and shipped:

• Linux: 156.0.8078.79
• Windows and macOS: 156.0.8078.79/.80

NVD lists that release post as the vendor advisory. Its CPE configuration marks every Chrome version up to, but excluding, 156.0.8078.79 as vulnerable. That makes 156.0.8078.79 the first fixed build.

There is no diff to show yet. Google keeps Chromium security bugs restricted until most users have updated, and none of the public sources we reviewed link the fixing commit in chromium/src. Once Google opens issue 575201795, it will normally link the Gerrit change and its backport to the M156 branch, which is where to look for the actual fix.

For a Chromium bug like this, the vendor version number is effectively the patch, and distributions rebuild against it.

Debian

• DSA-6605-1, dated November 2, 2026, ships chromium 156.0.8078.79-1~deb13u1 for trixie.
• The security tracker commit that adds the DSA names CVE-2026-119265 alongside CVE-2026-119260 through CVE-2026-119272 and CVE-2026-76024 through CVE-2026-76031.
• Fixed: trixie (security) 156.0.8078.79-1~deb13u1 and sid 156.0.8078.79-1.
• Still vulnerable: forky (156.0.8078.47-1).
• Still marked vulnerable: bookworm (security) at 156.0.8078.79-1~deb12u1, because no fixed version entry has been recorded for bookworm yet.

Gentoo

• Bug 985241 tracks the release.
• Commit 0c32af148e5b added the www-client/google-chrome 156.0.8078.79 ebuild on October 31, 2026.
• The bug also covers other Chromium-based packages: chromium, microsoft edge, opera and vivaldi. Each will be fixed when its build moves to the patched Chromium 156 base.

What to do

• Treat any Chrome or Chromium build at 156.0.8078.79 or later, or a distribution package built from that version, as fixed.
• The fix is a vendor binary and source release, not a separate patch you can apply on your own.
• If you build Chromium from source, update your checkout to the 156.0.8078.79 tag rather than trying to find and cherry pick the restricted commit.

On desktop Chrome, open Help, then About Google Chrome, let it check for updates, and select Relaunch to apply them. Google notes that ordinary tabs and windows reopen after the restart, but Incognito windows do not.

Detection methods

You can find installs vulnerable to CVE-2026-119265 by checking browser versions, but there is no public way to detect exploitation yet. Every check we confirmed compares the installed Chrome or Chromium version against the fixed build. We found no CVE-specific indicators of compromise, YARA or Sigma rules, Snort or Suricata signatures, or Nuclei templates. That makes this an asset inventory and patch verification problem rather than a network or EDR signature problem.

Version checks are the only reliable signal for three reasons:

• The trigger is a crafted HTML page whose technical details are restricted.
• A malicious page would look like ordinary HTTPS web traffic.
• The resulting execution stays inside the renderer sandbox.

Any desktop Chrome build earlier than 156.0.8078.79 is in scope.

Tenable Nessus and Tenable Cloud

Tenable's plugin page for this CVE lists six plugins. The ones we reviewed:

• 373883, Google Chrome < 156.0.8078.79 Multiple Vulnerabilities (Windows), file google_chrome_156_0_8078_79.nasl.
  • Local check that needs the installed_sw/Google Chrome KB item, so it requires an authenticated scan or an agent.
  • Tenable says Nessus relied only on the application's self-reported version number and did not test for the issues directly.
  • The optional thorough checks setting helps find extra or per-user Chrome installs.
• 373884, the same check for macOS, file macosx_google_chrome_156_0_8078_79.nasl, in the MacOS X Local Security Checks family. It also uses the self-reported version.
• 374236, Linux Distros Unpatched Vulnerability: CVE-2026-119265, file unpatched_CVE_2026_119265.nasl, Unix agent.
  • Flags distribution chromium packages (Debian 12, 13 and 14 CPEs) based on vendor package data.
  • Requires local checks and the global_settings/vendor_unpatched setting, so it only reports if vendor unpatched reporting is turned on in your scan policy.
• 374952, FreeBSD chromium security fixes (VuXML). Checks pkg_info for vulnerable chromium and ungoogled chromium packages.
• 478235, Echo: chromium security update to 156.0.8078.79, for Tenable Cloud Security and Tenable Self Hosted Container Security. Use it to find vulnerable Chromium baked into container images and cloud workloads, which endpoint scans often miss.

Rapid7

The Rapid7 Vulnerability Database lists the CVE as Covered by Rapid7 for Google Chrome, with coverage added October 30, 2026. InsightVM and Nexpose users can run their standard authenticated Chrome checks to find exposed hosts.

Checking Linux packages by hand

On Debian-based systems, compare the installed chromium package against the Debian Security Tracker rather than relying on the upstream version string alone. At the time of review:

• Fixed: trixie security (156.0.8078.79-1~deb13u1, DSA-6605-1) and sid (156.0.8078.79-1).
• Still marked vulnerable: bookworm, including the bookworm security build, and forky (156.0.8078.47-1).

Check the tracker status for your release instead of assuming a matching version number means the host is fixed.

What a version check cannot tell you

• Pending restarts: Chrome downloads updates in the background, but the fix only applies after a browser restart. A host can report a patched version while a vulnerable process is still running. Pair scanner results with restart enforcement or your management tooling's view of the running version.
• Other Chromium-based browsers: the plugins above cover Google Chrome and distribution Chromium packages. Track other Chromium-based browsers separately against their vendors' advisories.
• No exploitation evidence: as of November 2, 2026, OffSeq's tracker shows no public Nuclei template, no Metasploit or Exploit DB module, no CISA KEV listing and no attack traffic on its sensors. Tenable rates Exploit Ease as "No known exploits are available." Generic browser exploitation telemetry from your EDR is the only possible behavioural signal, and it would not be specific to this CVE.

The practical approach is to run authenticated or agent-based scans, or an equivalent inventory query, across Windows, macOS, Linux, FreeBSD and container images. Flag any Chrome below 156.0.8078.79 and any Chromium package your distribution's tracker still marks vulnerable. Then rescan after restarts to confirm the fix is live.

Affected systems and versions

• Google Chrome desktop, all platforms: all versions before 156.0.8078.79 (NVD CPE: up to, excluding, 156.0.8078.79).
• Windows and macOS: fixed in 156.0.8078.79/.80.
• Linux: fixed in 156.0.8078.79.
• Debian chromium:
  • Fixed: trixie security 156.0.8078.79-1~deb13u1 and sid 156.0.8078.79-1.
  • Still marked vulnerable at review time: forky 156.0.8078.47-1 and bookworm security 156.0.8078.79-1~deb12u1, because no bookworm fixed entry has been recorded.
• FreeBSD: chromium and ungoogled chromium packages below the fixed version, per Tenable plugin 374952.
• Other Chromium-based browsers: Gentoo bug 985241 covers chromium, microsoft edge, opera and vivaldi, which are fixed only once each moves to the patched Chromium 156 base.
• Container images and cloud workloads that bundle Chromium below 156.0.8078.79, per Tenable plugin 478235.

No special configuration is required for exposure beyond running an affected build and loading attacker-supplied HTML.

Vendor security history

Google's July 30, 2026 security article lays out its current approach:

• weekly security updates
• a transition of major milestones to a two-week cadence
• a pilot of two security releases per week, which does not indicate universal rollout
• a memory safety strategy that hardens existing C++ code while moving toward memory-safe languages

Google also acknowledges that most Chromium code remains C++ and that runtime mitigations carry costs and eventual limits. The Quota bugs in this release show that this work reduces memory corruption but has not eliminated it.

A relevant historical case is CVE-2025-2783, an incorrect handle issue in Mojo affecting Chrome on Windows before 134.0.6998.177. Unlike the Quota bug, NVD describes it as a sandbox escape.

• Kaspersky reported that Operation ForumTroll used phishing emails to exploit it against media, educational and government organizations in Russia, and attributed the activity to a state-sponsored APT group.
• Google released a fix on March 25, 2025.
• CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on March 27, 2025.

That case shows both the limits of browser isolation and the value of fast patch delivery. It does not establish any shared campaign, mechanism or actor with CVE-2026-119265.

References

• NVD: CVE-2026-119265
• CVE Record (cveawg.mitre.org): CVE-2026-119265
• Chrome Releases: Stable Channel Update for Desktop (October 2026)
• Chromium Issue 575201795 (restricted)
• Debian Security Tracker: CVE-2026-119265
• Debian Security Tracker commit adding DSA-6605-1
• Gentoo Bug 985241
• Tenable: Plugins for CVE-2026-119265
• Tenable Nessus Plugin 373883 (Windows)
• Tenable Nessus Plugin 373884 (macOS)
• Tenable Nessus Plugin 374236 (Linux distros unpatched)
• Tenable Nessus Plugin 374952 (FreeBSD)
• Tenable: CVE-2026-119265
• Rapid7 Vulnerability Database: CVE-2026-119265
• OffSeq Threat Radar entry
• GovCERT.HK Security Alert A26 10 65
• HKCERT: Google Chrome Multiple Vulnerabilities
• GitHub Advisory GHSA-pxjg-5pmw-3vm6
• Snyk: CVE-2026-119265 in chromium
• CVEFeed: CVE-2026-119265
• TheHackerWire: CVE-2026-119265
• SecurityOnline: Chrome 156 Security Update
• Google Chrome Help: Update Google Chrome
• Google: How to Update Chrome
• Statcounter: Browser Market Share Worldwide
• PiunikaWeb: Chrome desktop browser market share, October 2026
• Google Blog: Stronger with every update
• Securelist: Operation ForumTroll
• NVD: CVE-2025-2783
• CISA Known Exploited Vulnerabilities Catalog
• FIRST: CVSS v3.1 Specification
• MITRE CWE-119