Tools AI-Found Vulnerability Register aifv-0115
Register entry
Chrome WebRTC: memory corruption
- CVE
- CVE-2026-113303
- Project
- Google Chrome
- Component
- WebRTC
- Finder
- OpenAI Codex Security (kylebot)
- Autonomy
- AI security system credited by the assigning vendor
- Evidence tier
- CNA credits the finder in its own advisory
- Assigner
- Chrome
- Severity
- Critical (Chromium security severity)
- Confidence
- CONFIRMED
What happened
Google’s Chrome 156 release credits OpenAI Codex Security (kylebot) with this WebRTC finding.
Credit as recorded: OpenAI Codex Security (kylebot). The release was published on 20 October 2026. Google lists the researcher report date as 2026-10-15. The fix is in 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and macOS. The listed reward is N/A, so the register records no confirmed payment. The public credit supplies no model version. Date basis: CNA publication and Chrome 156 release; researcher report date 2026-10-15.
Sources
- Chrome 156 release and original creditchromereleases.googleblog.com/2026/10/stable-channel-update-…
- Canonical CVE recordraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026