CVE-2026-113039 Google CVE debrief

Who should care

Google Chrome users, particularly those with version 156.0.8078.47 or earlier, should assess their exposure and consider updating to the latest version. IT administrators and security teams responsible for Chrome deployments should prioritize verifying versions and planning updates. This vulnerability could impact Chrome users with outdated versions, potentially allowing arbitrary code execution within the sandbox.

Why it matters

CVE-2026-113039 is a use-after-free vulnerability in Google Chrome's Bookmarks feature. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to mitigate potential risks.

• Potential for arbitrary code execution within the sandbox
• Possible impact on Chrome users with outdated versions

Technical summary

A use-after-free vulnerability exists in the Bookmarks feature of Google Chrome prior to version 156.0.8078.47. This vulnerability could allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability was reported and patched, with users advised to update to the latest version to mitigate risks. Technical details are limited to CVE Program and NVD records, which indicate a low severity rating by Chromium security standards. Defenders should focus on verifying Chrome versions and updating to mitigate potential risks.

Defensive priority

Defenders should prioritize verifying Chrome version and updating to 156.0.8078.47 or later.

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Monitor for suspicious activity
• Implement sandboxing and isolation measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the full scope of affected systems and potential impact. Evidence is limited to CVE Program and NVD records. Defenders should verify Chrome versions, review official advisories, and consider updating to the latest version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.