CVE-2026-113009 Google CVE debrief

Who should care

Google Chrome users, particularly those with versions prior to 156.0.8078.47, should assess exposure and verify if their browser is updated to the latest version. This includes users who may be impacted by the vulnerability and need to take action to prevent exploitation. Additionally, security teams and vulnerability management teams should review the CVE record and NVD entry to understand the affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-113009 is a use-after-free vulnerability in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47. The vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Defenders should prioritize updating Google Chrome to version 156.0.8078.47 or later and monitor for potential exploitation attempts.

• Remote attackers may execute arbitrary code inside the sandbox
• Successful exploitation requires user interaction via a crafted HTML page
• Defenders should prioritize updating Google Chrome to version 156.0.8078.47 or later
• Exposure verification and monitoring for potential exploitation attempts are necessary

Technical summary

A use-after-free vulnerability in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has a Medium severity level according to Chromium. The affected product is Google Chrome, and defenders should prioritize updating to version 156.0.8078.47 or later. The vulnerability requires user interaction via a crafted HTML page, and exposure verification and monitoring for potential exploitation attempts are necessary.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure to Google Chrome version 156.0.8078.47 and earlier
• Verify if Google Chrome is updated to the latest version
• Monitor for potential exploitation attempts
• Implement compensating controls to prevent exploitation
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry indicate a use-after-free vulnerability in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47. The Chromium security severity is Medium. This information is based on the official CVE Program record and the NVD entry. The vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The source details are limited, and defenders should verify the exposure and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.