CVE-2026-113078
Critical · 9.6CVSS
9.6
EPSS
0.3%
Published
Oct 20, 2026
CISA due date
—
The record
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121245 Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-367
- CVE-2026-121050 Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a… CWE-367
- CVE-2026-121048 Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to… CWE-367
- CVE-2026-88968 Claude Code is an agentic coding tool. CWE-367
- CVE-2026-119977 WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. CWE-367
- CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-367
- CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-367
- CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate… CWE-367