CVE-2026-113014 Google CVE debrief

Who should care

Google Chrome users, particularly those with versions prior to 156.0.8078.47, should assess exposure and update to the latest version. This includes administrators and security teams responsible for managing Chrome deployments within their organizations. They should review the official CVE record and NVD entry for detailed information on the vulnerability and recommended actions.

Why it matters

CVE-2026-113014 is a use-after-free vulnerability in PerformanceAPIs in Google Chrome prior to 156.0.8078.47. Defenders should assess exposure, prioritize updates, and monitor for potential exploitation attempts.

• Potential execution of arbitrary code outside the sandbox
• Remote attackers could exploit this vulnerability via crafted HTML pages
• Defenders should prioritize updating Chrome to version 156.0.8078.47 or later

Technical summary

A use-after-free vulnerability exists in PerformanceAPIs in Google Chrome prior to 156.0.8078.47. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability has a Medium security severity according to Chromium. The affected product context includes Google Chrome versions prior to 156.0.8078.47, and defenders should prioritize updates to mitigate potential risks. Technical details are based on CVE Program and NVD records, which provide a foundation for understanding the vulnerability but may not encompass all possible exploitation scenarios.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure to vulnerable Chrome versions
• Update Chrome to version 156.0.8078.47 or later
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on a use-after-free vulnerability in PerformanceAPIs in Google Chrome prior to 156.0.8078.47. The Chromium security severity is Medium. Evidence is limited to CVE Program and NVD records, which may not cover all affected scenarios or exploitation attempts. Defenders should verify exposure and monitor for potential exploitation attempts within their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.