PatchSiren cyber security CVE debrief

CVE-2026-113043 Google CVE debrief

CVE-2026-113043 debrief based on CVE Program and NVD records. Google Chrome on iOS prior to 156.0.8078.47 is vulnerable to a use-after-free issue in iOSWeb, allowing remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. The vulnerability exists in the iOSWeb component of Google Chrome on iOS, which is a critical part of the browser's functionality. This issue is particularly concerning because it can be exploited through a crafted HTML page, which could be delivered through various means such as email or web browsing. The use-after-free vulnerability allows an attacker to execute arbitrary code inside the sandbox, which could lead to a range of nefar

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-21
Advisory published: 2026-10-20
Advisory updated: 2026-10-21

Who should care

Defenders responsible for managing Google Chrome on iOS systems should assess exposure and prioritize updating to version 156.0.8078.47 or later. This includes IT administrators, security teams, and anyone responsible for maintaining Chrome installations on iOS devices. They should verify the version of Chrome on iOS systems and update to the latest version to prevent exploitation of this vulnerability. Additionally, defenders should review compensating

Why it matters

CVE-2026-113043 is a use-after-free vulnerability in Google Chrome on iOS, allowing remote code execution inside the sandbox. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later.

Remote attackers may execute arbitrary code inside the sandbox
Successful exploitation requires user interaction via crafted HTML pages
Defenders should verify Chrome versions on iOS systems
Remediation priority is high due to potential code execution

Technical summary

A use-after-free vulnerability exists in iOSWeb of Google Chrome on iOS prior to 156.0.8078.47. This allows remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. The Chromium security severity of this issue is rated as Medium. The vulnerability is caused by a use-after-free issue in the iOSWeb component, which allows remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. The technical details of the vulnerability indicate that it is a use-after-free issue in the iOSWeb component of Google Chrome on iOS.

Defensive priority

High

Recommended defensive actions

Update Google Chrome on iOS to version 156.0.8078.47 or later
Verify iOS systems for Chrome updates
Monitor Chrome on iOS for suspicious activity
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records confirm a use-after-free vulnerability in Google Chrome on iOS prior to 156.0.8078.47. Chromium security severity is rated as Medium. The vulnerability is caused by a use-after-free issue in the iOSWeb component, which allows remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. The evidence from the CVE Program and NVD records indicates that this vulnerability is a result of a use-after-free issue, which can be exploited through a crafted HTML page. The Chromium issue

Sources and references

Verified primary and authoritative sources

CVE-2026-113043 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113043

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113043 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113043

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113043
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113043.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/521978171

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.