NVD publishes three new Chrome 156 vulnerabilities in V8, ComputePressure and ANGLE

What happened

These three flaws add to those covered in our 21 October story, "Google fixes 353 vulnerabilities in Chrome 156, six of them critical". They belong to the same release, which Google announced on 20 October on its Chrome Releases blog, and NVD has now published their records and scores.

All three can be triggered by a remote attacker if the victim opens a specially crafted HTML page:

• CVE-2026-113030 (CVSS 8.8): improper access control in V8, Chrome's JavaScript engine, which could let an attacker bypass the web origin policy, the safeguard that stops one website from accessing another's data.
• CVE-2026-113057 (CVSS 8.8): improper access control in the ComputePressure component, allowing the same web origin policy bypass.
• CVE-2026-113143 (CVSS 8.8): memory corruption in ANGLE, Chrome's graphics component, which lets an attacker read process memory.

Who is affected

Google Chrome versions before 156.0.8078.47 are affected. According to Google's advisory, the fixed release is 156.0.8078.47 on Linux and 156.0.8078.47/.48 on Windows and Mac, rolling out gradually over the coming days and weeks.

Note the difference in ratings: NVD scores all three at CVSS 8.8 (high), while the Chromium team itself rates them as medium severity. For prioritisation, what matters is that a single update fixes them all.

Exploitation status

None of them appear in CISA's KEV catalogue, so there is no confirmed active exploitation, and no public exploit is known. FIRST puts the likelihood of exploitation in the next month at 0.2%, so it is currently considered unlikely. Even so, the attack is straightforward, since a user only needs to visit a malicious website, and Google is keeping technical details restricted until most users have updated.

What to do

If you already rolled out Chrome 156 after our previous story, no further action is needed: that update also fixes these three flaws. If not, now is the time.

• Update Google Chrome to version 156.0.8078.47 (Linux) or 156.0.8078.47/.48 (Windows and Mac).
• Check the version under Settings > About Chrome and restart the browser so the patch takes effect.
• In managed environments, push the update through your management console or corporate policies rather than waiting for Google's staged rollout.
• Review your asset inventory for Chrome installations that do not update automatically.

Sources

• Google Chrome Releases: Stable Channel Update for Desktop (Chrome 156)

Affected technologies

Vulnerabilities (3)