PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113087 Google CVE debrief

CVE-2026-113087 debrief based on CVE Program and NVD records. Google Chrome users should assess exposure to version 156.0.8078.47 and earlier. The CVE record was published on 2026-10-20T21:02:28.767Z and has not been modified since then. This use-after-free vulnerability in Google Chrome's Actor component could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. Chrome users should prioritize patching to version 156.0.8078.47 or later. The vulnerability's severity is classified as Medium by Chromium, indicating a potential risk that should be addressed promptly.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-21
Advisory published
2026-10-20
Advisory updated
2026-10-21

Who should care

Google Chrome users, particularly those in environments where Chrome is used for browsing or rendering web content, should assess their exposure to this vulnerability and ensure that Chrome is updated to version 156.0.8078.47 or later.

Why it matters

CVE-2026-113087 is a use-after-free vulnerability in Google Chrome's Actor component that could allow remote attackers to execute arbitrary code inside the sandbox. Chrome users should prioritize patching to version 156.0.8078.47 or later.

  • Remote attackers may be able to execute arbitrary code inside the Chrome sandbox.
  • Successful exploitation could lead to unauthorized actions within the sandbox.
  • Defenders should prioritize patching Chrome to prevent potential exploitation.
  • Verification of Chrome version and monitoring for suspicious activity are recommended.

Technical summary

A use-after-free vulnerability exists in the Actor component of Google Chrome prior to version 156.0.8078.47. This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is classified as a use-after-free issue, which occurs when the program attempts to access memory that has already been freed or deleted. In this case, the vulnerability is triggered by a crafted HTML page, which can cause the Chrome browser to execute arbitrary code inside the sandbox. Chrome users should prioritize patching to version 156.0.8078.47 or later to prevent potential exploitation.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply Google Chrome updates to ensure version 156.0.8078.47 or later is deployed.
  • Monitor Google Chrome for additional security advisories and apply patches promptly.
  • Verify that Chrome is properly configured and that users are restricted from accessing suspicious or untrusted websites.
  • Conduct a thorough review of Chrome configurations and user access controls.
  • Implement additional monitoring to detect potential exploitation attempts.
  • Perform a detailed asset inventory to identify all instances of Google Chrome in the environment.
  • Establish a change management process to ensure timely application of Chrome updates.

Evidence notes

The CVE record and NVD entry indicate a use-after-free vulnerability in Google Chrome's Actor component, allowing remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113087 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113087

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113087 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113087

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113087

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113087.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/558301759

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.