PatchSiren cyber security CVE debrief

CVE-2026-113074 Google CVE debrief

CVE-2026-113074 debrief based on CVE Program and NVD records. Google Chrome on Windows prior to 156.0.8078.47 is vulnerable to a use-after-free issue in the Media component, potentially allowing remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability exists in the Media component of Google Chrome on Windows, which could allow attackers to execute code within the sandbox. This issue is particularly concerning for environments where users access untrusted web content. Defenders should assess exposure and apply patches to mitigate potential risks.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for managing Google Chrome deployments on Windows, especially in environments where users access untrusted web content, should assess exposure and apply patches.

Why it matters

CVE-2026-113074 is a use-after-free vulnerability in Google Chrome's Media component on Windows, potentially allowing remote code execution within the sandbox. Defenders should prioritize patching and verifying version compliance, especially in environments accessing untrusted web content.

Potential remote code execution within the sandbox
Need to verify version compliance for Google Chrome on Windows
Possible exploitation attempts targeting this vulnerability
Requirement to assess exposure in environments accessing untrusted web content

Technical summary

A use-after-free vulnerability exists in the Media component of Google Chrome on Windows prior to version 156.0.8078.47. This issue allows remote attackers to potentially execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability is caused by a use-after-free issue in the Media component, which could allow attackers to execute code within the sandbox. Defenders should prioritize assessing exposure and applying patches for Google Chrome on Windows, especially in environments where untrusted web content is accessed.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Google Chrome on Windows, especially in environments where untrusted web content is accessed.

Recommended defensive actions

Assess exposure of Google Chrome on Windows to this vulnerability
Apply patches for Google Chrome on Windows to version 156.0.8078.47 or later
Monitor for potential exploitation attempts targeting this vulnerability
Verify version information for Google Chrome on Windows to ensure compliance
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in Google Chrome versions prior to 156.0.8078.47 on Windows. However, specific exploitation details and victim information are not provided.

Sources and references

Verified primary and authoritative sources

CVE-2026-113074 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113074

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113074 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113074

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113074
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113074.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/563003907

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.