CVE-2026-113088 Google CVE debrief

Who should care

Android users and administrators who use Google Chrome on Android devices should assess exposure and apply the patch to prevent potential exploitation. They should verify that Chrome is updated to the latest version on all Android devices and consider implementing sandboxing and isolation measures for Chrome on Android. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-113088 is a memory corruption vulnerability in Google Chrome on Android that could allow potential code execution inside the sandbox. Android users and administrators should assess exposure and apply the patch to prevent potential exploitation.

• Potential code execution inside the sandbox via crafted HTML page requires verification
• Applying the patch to version 156.0.8078.47 or later is recommended
• Monitoring for crafted HTML pages that could exploit this vulnerability is necessary
• Verifying Chrome version on all Android devices is essential

Technical summary

Memory corruption vulnerability in Google Chrome on Android prior to version 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability is rated as Low by Chromium and affects Android users and administrators who use Google Chrome on Android devices. They should assess exposure and apply the patch to prevent potential exploitation. The patch is available in version 156.0.8078.47 or later. Users should verify that Chrome is updated to the latest version on all Android devices.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch for Google Chrome on Android to version 156.0.8078.47 or later
• Monitor for potential crafted HTML pages that could exploit this vulnerability
• Verify that Chrome is updated to the latest version on all Android devices
• Consider implementing sandboxing and isolation measures for Chrome on Android
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program record and NIST NVD detail page provide information on the memory corruption vulnerability in Google Chrome on Android. The Chromium security severity is rated as Low. Evidence is limited to publicly available sources and may not reflect the full scope or impact of this vulnerability. Defenders should verify Chrome version on all Android devices and monitor for crafted HTML pages that could exploit this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.