CVE-2026-113072 Google CVE debrief

Who should care

Chrome users, particularly those in environments where exposure to untrusted HTML pages is possible, should assess and prioritize updating to the latest version. This includes users in environments where Chrome is widely used, as the vulnerability's critical severity and potential for code execution make timely remediation and verification of Chrome deployments crucial. Operators, security teams, and platform administrators should review and verify Chrome

Why it matters

CVE-2026-113072 is a critical memory corruption vulnerability in Google Chrome's CSS processing. It allows remote attackers to potentially execute arbitrary code outside the sandbox via crafted HTML pages. Chrome users, especially in environments exposed to untrusted HTML pages, should prioritize updating to version 156.0.8078.47 or later. The vulnerability's critical severity and potential for code execution make timely remediation and verification of Chrome deployments crucial.

• Potential code execution outside the sandbox via crafted HTML pages
• Exposure to untrusted HTML pages may lead to arbitrary code execution
• Verification of Chrome version updates is crucial for mitigating potential risks
• Remediation priority is high for environments where Chrome is widely used

Technical summary

Memory corruption in CSS processing in Google Chrome prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This critical vulnerability in Google Chrome's CSS processing enables remote attackers to execute arbitrary code outside the sandbox. Chrome users should update to version 156.0.8078.47 or later to mitigate potential code execution risks. Technical details indicate a high severity rating due to potential code execution outside the sandbox.

Defensive priority

High priority for Chrome users to update to version 156.0.8078.47 or later to mitigate potential code execution risks.

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review and monitor HTML page processing in Chrome for potential crafted page exposure
• Assess and verify version updates across Chrome deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's CSS processing. Chromium security severity is rated as Critical. The vulnerability allows remote attackers to potentially execute arbitrary code outside the sandbox via crafted HTML pages. Evidence is limited to CVE Program and NVD details. Defenders should verify Chrome version updates and review HTML page processing for potential crafted page exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.