PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113099 Google CVE debrief

CVE-2026-113099 debrief based on CVE Program and NVD records. Google Chrome for Android prior to 156.0.8078.47 has an improper input validation vulnerability in Omnibox. This could allow a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is classified as Medium severity according to Chromium. Defenders should assess exposure and prioritize updating to the latest version. The CVE record and NVD entry provide details on the vulnerability, but the CVSS score and severity are not available.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-21
Advisory published
2026-10-20
Advisory updated
2026-10-21

Who should care

Defenders responsible for managing Google Chrome on Android devices should assess exposure and prioritize updating to the latest version. This includes security teams, IT administrators, and vulnerability management teams. They should verify versions and prioritize updates to prevent potential exploitation attempts.

Why it matters

CVE-2026-113099 is a Medium severity vulnerability in Google Chrome on Android that could allow remote code execution. Defenders managing Chrome on Android should verify versions and prioritize updates.

  • Potential execution of arbitrary code inside the sandbox
  • Remote attacker exploitation via crafted HTML page
  • Medium severity vulnerability according to Chromium

Technical summary

The vulnerability is caused by improper input validation in Omnibox in Google Chrome on Android prior to 156.0.8078.47. This could allow a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is classified as Medium severity according to Chromium. The CVE record and NVD entry provide details on the vulnerability, but the CVSS score and severity are not available. Defenders should assess exposure and prioritize updating to the latest version. The vulnerability affects Google Chrome on Android devices.

Defensive priority

Medium

Recommended defensive actions

  • Update Google Chrome to version 156.0.8078.47 or later
  • Review and verify the version of Google Chrome on Android devices
  • Monitor for potential exploitation attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the CVSS score and severity are not available. The Chromium security severity is listed as Medium. Defenders should verify versions and prioritize updates. The vulnerability is caused by improper input validation in Omnibox in Google Chrome on Android prior to 156.0.8078.47.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113099 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113099

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113099 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113099

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113099

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113099.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/556227230

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.