PatchSiren cyber security CVE debrief

CVE-2026-113026 Google CVE debrief

A memory corruption vulnerability in PDF in Google Chrome on Android prior to 156.0.8078.47 allows a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. This issue is caused by a memory corruption in the PDF component of Google Chrome on Android. The vulnerability allows a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Defenders should assess exposure and prioritize updating Chrome to version 156.0.8078.47 or later.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-21
Advisory published: 2026-10-20
Advisory updated: 2026-10-21

Who should care

Defenders responsible for managing Google Chrome installations on Android devices should assess exposure and prioritize updating Chrome to version 156.0.8078.47 or later. This includes IT teams, security teams, and administrators who manage Google Chrome deployments on Android devices. They should verify the version of Google Chrome on Android devices and update it to version 156.0.8078.47 or later to prevent potential memory corruption attacks.

Why it matters

The memory corruption vulnerability in Google Chrome on Android allows a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Defenders should prioritize verifying and updating Google Chrome to version 156.0.8078.47 or later on Android devices.

Verify Google Chrome version on Android devices to prevent potential memory corruption attacks
Update Google Chrome to version 156.0.8078.47 or later to fix the vulnerability
Monitor Google Chrome for any security advisories related to this vulnerability

Technical summary

The vulnerability is caused by a memory corruption issue in the PDF component of Google Chrome on Android. This issue allows a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. The vulnerability affects Google Chrome on Android prior to version 156.0.8078.47. Defenders should prioritize verifying and updating Google Chrome to version 156.0.8078.47 or later on Android devices to prevent potential memory corruption attacks. The issue is related to the PDF component of Google Chrome.

Defensive priority

Defenders should prioritize verifying and updating Google Chrome to version 156.0.8078.47 or later on Android devices to prevent potential memory corruption attacks.

Recommended defensive actions

Verify Google Chrome version on Android devices
Update Google Chrome to version 156.0.8078.47 or later
Monitor Google Chrome for any security advisories
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome on Android. The vulnerability allows a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

CVE-2026-113026 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113026

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113026 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113026

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113026
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113026.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/500173014

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.