CVE-2026-112993 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updating to version 156.0.8078.47 or later. This includes IT teams managing Chrome installations, security teams monitoring for potential threats, and operators responsible for maintaining browser updates. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-112993 is a high-severity use-after-free vulnerability in Google Chrome's Input component. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to prevent potential remote code execution inside the sandbox.

• Remote code execution inside the sandbox
• Potential for attacker exploitation
• Need for version verification and updating

Technical summary

A use-after-free vulnerability exists in the Input component of Google Chrome prior to version 156.0.8078.47. This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was published on 2026-10-20T21:01:57.891Z and has not been modified since then. The CVE Program and NVD records provide additional details on the vulnerability. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to prevent potential remote code execution inside the sandbox.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later.

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Monitor for suspicious activity in Chrome
• Implement sandboxing and isolation measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, but do not specify versions beyond 156.0.8078.47 being affected. The Input component of Google Chrome prior to version 156.0.8078.47 is vulnerable. Defenders should verify Chrome versions and update to 156.0.8078.47 or later. Additional information may be found in the official CVE Program record and the NVD vulnerability detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.