PatchSiren cyber security CVE debrief

CVE-2026-113004 Google CVE debrief

PatchSiren debrief for CVE-2026-113004: Memory corruption in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability impacts Google Chrome deployments, and defenders should assess exposure and prioritize updates to 156.0.8078.47 or later. The CVE record confirms the memory corruption vulnerability, and defenders should verify Chrome versions and monitor for crafted HTML pages. The vulnerability allows remote attackers to execute arbitrary code inside the sandbox.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for Google Chrome deployments should assess exposure and prioritize updates to 156.0.8078.47 or later. This includes verifying Chrome versions, monitoring for crafted HTML pages, and reviewing sandbox configurations. Additionally, defenders should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-113004 is a memory corruption vulnerability in Google Chrome that allows remote attackers to execute arbitrary code inside the sandbox. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later.

Remote attackers may execute arbitrary code inside the sandbox
Verify Chrome versions and update to 156.0.8078.47 or later
Monitor for crafted HTML pages

Technical summary

Memory corruption vulnerability in Sync in Google Chrome prior to 156.0.8078.47 allows remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. This vulnerability impacts Google Chrome deployments, and defenders should assess exposure and prioritize updates to 156.0.8078.47 or later. The CVE record confirms the memory corruption vulnerability, and defenders should verify Chrome versions and monitor for crafted HTML pages. The vulnerability allows remote attackers to execute arbitrary code inside the sandbox.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later.

Recommended defensive actions

Verify Chrome version and update to 156.0.8078.47 or later
Monitor for crafted HTML pages
Review sandbox configurations
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Review compensating controls for exposed systems while remediation is scheduled and verified.
Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Official CVE Program record and NIST NVD detail page confirm memory corruption vulnerability in Google Chrome. The CVE record was published on 2026-10-20T21:02:39.684Z and has not been modified since then. Defenders should verify Chrome versions and update to 156.0.8078.47 or later. The source item for CVE-2026-113004 and supplemental source references provide additional context.

Sources and references

Verified primary and authoritative sources

CVE-2026-113004 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113004

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113004 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113004

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113004
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113004.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/513394775

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.