CVE-2026-113055 Google CVE debrief

Who should care

IT and security teams responsible for managing Google Chrome deployments on Android devices should assess exposure and prioritize updating Chrome to the latest version. This vulnerability highlights the importance of maintaining up-to-date browser versions to mitigate potential threats.

Why it matters

CVE-2026-113055 is a type confusion vulnerability in Google Chrome's FullScreen feature on Android that allows remote code execution within the sandbox. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later and verify exposure across their organization.

• Remote code execution within the sandbox requires verification of Chrome version and exposure
• Keeping browser versions current is crucial to prevent potential threats
• This vulnerability highlights the need for regular security updates and monitoring of browser versions

Technical summary

The CVE-2026-113055 vulnerability is a type confusion issue in the FullScreen feature of Google Chrome on Android. This vulnerability allows a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The issue was reported with a medium severity rating by the Chromium security team. Affected product deployments should be reviewed to ensure Chrome is up-to-date, and compensating controls should be considered for exposed systems while remediation is scheduled. Monitoring and detection capabilities should also be reviewed to identify potential threats.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later on Android devices
• Verify that Chrome is up-to-date on all Android devices
• Monitor Chrome version usage across the organization to ensure compliance
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. However, the record does not provide explicit information on exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.