CVE-2026-113107 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome on Android deployments should assess exposure and apply necessary patches or updates. IT teams overseeing Android environments with Google Chrome installed need to prioritize patching to prevent potential code execution within the sandbox. Security teams should verify sandboxing configurations and monitor for potential exploitation attempts. Operational teams may need to review compensating controls for at

Why it matters

CVE-2026-113107 is a use-after-free vulnerability in Google Chrome on Android that could allow remote code execution within the sandbox. Defenders should assess exposure, apply patches, and verify sandboxing configurations.

• Potential remote code execution within the sandbox
• Exposure of Google Chrome on Android versions prior to 156.0.8078.47
• Need for patching or updating Google Chrome on Android
• Verification of sandboxing configurations for Google Chrome on Android

Technical summary

A use-after-free vulnerability exists in the Media component of Google Chrome on Android prior to version 156.0.8078.47. This issue could potentially allow remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability is considered low severity. Technical details indicate that the issue arises from improper handling of media components after they have been freed, which can lead to code execution under certain conditions. No specific technical details on exploits are publicly available.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Google Chrome on Android versions prior to 156.0.8078.47.

Recommended defensive actions

• Assess exposure of Google Chrome on Android versions prior to 156.0.8078.47
• Apply patches or updates to Google Chrome on Android to version 156.0.8078.47 or later
• Monitor Google Chrome on Android for potential exploitation attempts
• Verify sandboxing configurations for Google Chrome on Android
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide initial details on the vulnerability. However, additional information on potential exploits or impacts is limited. There are no known reports of exploitation in the wild. The CVE Program and NVD entries serve as primary sources for this vulnerability's details. Further verification and monitoring are recommended to ensure exposure is managed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.