CVE-2026-113108 Google CVE debrief

Who should care

Chrome users, IT administrators responsible for Chrome deployments, and security teams monitoring browser vulnerabilities should be aware of this vulnerability. They should prioritize updating to version 156.0.8078.47 or later to mitigate potential risks. Additionally, security teams should review Chrome installations, monitor for suspicious activity, and ensure that all instances are updated to the latest version.

Why it matters

CVE-2026-113108 is a use-after-free vulnerability in Google Chrome's Script component. It allows remote attackers to potentially execute arbitrary code within the sandbox via crafted HTML pages. Chrome users should update to version 156.0.8078.47 or later to mitigate this vulnerability.

• Potential remote code execution within the sandbox.
• Requires immediate attention for Chrome users to update.
• May impact organizations using Chrome for critical operations.

Technical summary

A use-after-free vulnerability exists in the Script component of Google Chrome prior to version 156.0.8078.47. This could allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability has been publicly disclosed, and Chrome users are advised to update to the latest version to mitigate potential risks. IT administrators should review their Chrome deployments and ensure that all instances are updated to version 156.0.8078.47 or later. Security teams should monitor for suspicious activity and review Chrome installations to prevent exploitation.

Defensive priority

High priority for Chrome users to update to version 156.0.8078.47 or later.

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later.
• Monitor Chrome releases for future updates.
• Review and update inventory of Chrome installations.
• Verify Chrome version in use and compare to the patched version.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Official CVE Program and NVD records confirm the vulnerability in Google Chrome. Limited details on exploitation or impact are available. Chrome users and IT administrators should verify their current version and update to 156.0.8078.47 or later. Defensive verification tasks include reviewing Chrome installations, monitoring for suspicious activity, and ensuring that security teams are aware of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.