CVE-2026-113311
published 2026-10-20CVE-2026-113311: Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted…
PriorityP355high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.44%
37.4th percentile
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 156.0.8078.47 | 156.0.8078.47 | |
| chrome | >= 156.0.8078.47 < 156.0.8078.47 | 156.0.8078.47 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2026-113150
vendor_chrome·2026-10-20·CVSS 9.6
CVE-2026-113150 [MEDIUM] Stable Channel Update for Desktop: CVE-2026-113150
Stable Channel Update for Desktop
CVE-2026-113150: Memory corruption in Bindings. Reported by Google on 2026-04-03 [N/A][ 499365667 ] Medium CVE-2026-113311: Use after free in ServiceWorker
Reported by Google on 2026-04-03 [TBD][ 499520020 ] Medium CVE-2026-113078: Improper input validation in Compositing
Severity: medium
Red Hat
kernel: wifi: wlcore: enable the right set of ciphers
vendor_redhat·2026-08-28·CVSS 5.5
CVE-2026-80641 [LOW] CWE-835 kernel: wifi: wlcore: enable the right set of ciphers
kernel: wifi: wlcore: enable the right set of ciphers
In the Linux kernel, the following vulnerability has been resolved:
wifi: wlcore: enable the right set of ciphers
The firmware version number check for IGTK introduced in
commit c34dbc5900b0 ("wifi: wlcore: Add support for IGTK key")
lets the amount of ciphers decrease on every boot of a too old firmware and
that is practically happening. It also does not take into account other
chips than the wl18xx. On some wl128x, the following can be observed
when connecting via nm to a common ap:
[ 484.113311] wlcore: WARNING could not set keys
[ 484.117828] wlcore: ERROR Could not add or replace key
[ 484.123016] wlan0: failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-5)
[ 484.123046] wlcore: Hardware recovery in progress. FW ver: Rev 7.3.1
GHSA
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
ghsa_unreviewed·2026-10-21
CVE-2026-113311 [HIGH] CWE-416 Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-113311 chromium-browser: chromium-browser: Arbitrary code execution in ServiceWorker via crafted HTML page
bugzilla·2026-10-20·CVSS 8.8
CVE-2026-113311 [HIGH] CVE-2026-113311 chromium-browser: chromium-browser: Arbitrary code execution in ServiceWorker via crafted HTML page
CVE-2026-113311 chromium-browser: chromium-browser: Arbitrary code execution in ServiceWorker via crafted HTML page
Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-80641 kernel: wifi: wlcore: enable the right set of ciphers
bugzilla·2026-08-28
CVE-2026-80641 [LOW] CVE-2026-80641 kernel: wifi: wlcore: enable the right set of ciphers
CVE-2026-80641 kernel: wifi: wlcore: enable the right set of ciphers
In the Linux kernel, the following vulnerability has been resolved:
wifi: wlcore: enable the right set of ciphers
The firmware version number check for IGTK introduced in
commit c34dbc5900b0 ("wifi: wlcore: Add support for IGTK key")
lets the amount of ciphers decrease on every boot of a too old firmware and
that is practically happening. It also does not take into account other
chips than the wl18xx. On some wl128x, the following can be observed
when connecting via nm to a common ap:
[ 484.113311] wlcore: WARNING could not set keys
[ 484.117828] wlcore: ERROR Could not add or replace key
[ 484.123016] wlan0: failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-5)
[ 484.123046] wlcore: Hardware recovery in progress
2026-10-20
Published