Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-119261 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
Advisories
- Patch day: Patch bundle: November 2026 Early Security Updates — 24 CVEs, 0 exploited (Nov 4)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-113430
Vulnerability Data
Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Developer testing and evaluation (including fuzzing and memory-error detectors) can discover heap overflows after they have been coded.
Security engineering principles require use of memory-safe constructs and bounds-checked allocation routines that avoid introducing heap overflows.
Input validation enforces bounds checking on data written to heap buffers, directly stopping the overflow condition from being introduced.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.
Timely patching removes known heap-overflow instances after they exist.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Security testing in development and acceptance can detect heap overflows before release.
Secure coding standards directly prescribe techniques (safe functions, bounds checks) that prevent heap-based buffer overflows.
A.8.30 carries its effect through the secure design, coding and testing practices its contract requires of the supplier (8.25-8.29), so a faithfully implemented clause reduces ordinary implementation-phase software weaknesses like heap-based buffer overflows in delivered code, but the effect is mediated by supplier practice and is bounded by the ceiling the owner has set on this clause for this verb.
A.8.8's reach is DISCLOSURE — it surfaces heap-based buffer overflows only where they appear as published CVEs in third-party components in the inventory. CWE-122 is overwhelmingly an implementation-phase defect in custom code, which A.8.8 does not read; the disclosed third-party share is a minority, matching the same logic that graded A.8.8 -> CWE-89 at `partial`.