PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113092 Google CVE debrief

CVE-2026-113092 debrief based on CVE Program and NVD records. Google Chrome on Android prior to 156.0.8078.47 is vulnerable to a use-after-free issue in the Passwords component, potentially allowing remote attackers to execute arbitrary code within the sandbox via crafted HTML pages. The vulnerability is considered high-severity and defenders should prioritize updates to mitigate potential risks. This issue is particularly concerning for organizations heavily reliant on Google Chrome for Android, as successful exploitation could lead to unauthorized code execution.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for managing Google Chrome deployments on Android devices should assess exposure and prioritize updates. Roles include IT administrators, security teams, and incident response personnel.

Why it matters

CVE-2026-113092 is a high-severity use-after-free vulnerability in Google Chrome's Passwords component on Android. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later, monitor for potential attacks, and verify device inventories.

  • Potential remote code execution within the sandbox
  • Required version update to 156.0.8078.47 or later
  • Monitoring for crafted HTML page attacks
  • Verification of Android device inventory and Chrome version

Technical summary

A use-after-free vulnerability exists in the Passwords component of Google Chrome on Android prior to version 156.0.8078.47. This issue allows remote attackers to potentially execute arbitrary code within the sandbox via specially crafted HTML pages. The vulnerability is a result of improper memory management, where memory is accessed after it has been freed. This can lead to unpredictable behavior, potentially allowing attackers to execute malicious code. Defenders should note that while the vulnerability is high-severity, its impact is limited to the sandbox environment, which restricts the potential damage.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 156.0.8078.47 or later on Android devices
  • Review and restrict HTML page rendering from untrusted sources
  • Monitor for potential sandbox escapes and code execution attempts
  • Verify Android device inventory and Chrome version
  • Assess exposure and prioritize updates for Google Chrome deployments on Android
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, specific impact and remediation details are limited. Further verification is needed to assess the full scope of affected systems and to confirm the effectiveness of proposed mitigations. Defenders should consult official Google Chrome documentation and security advisories for additional guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113092 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113092

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113092 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113092

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113092

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113092.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/558377544

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.