PatchSiren cyber security CVE debrief

CVE-2026-113110 Google CVE debrief

A memory corruption vulnerability in Google Chrome's ShadowDOM prior to version 156.0.8078.47 could allow remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This issue, tracked as CVE-2026-113110, was publicly disclosed on October 20, 2026, and has a medium severity rating according to Chromium. The vulnerability was addressed in a stable channel update for desktop.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-21
Advisory published: 2026-10-20
Advisory updated: 2026-10-21

Who should care

Defenders responsible for managing Google Chrome installations, particularly in environments where remote exploitation is a concern, should assess exposure and prioritize patching.

Why it matters

CVE-2026-113110 is a medium-severity vulnerability in Google Chrome's ShadowDOM feature that could allow remote code execution within the sandbox. Defenders should prioritize patching vulnerable installations to prevent potential exploitation.

Potential for remote code execution within the sandbox requires immediate patching priority
Defenders must verify Chrome versions and update to 156.0.8078.47 or later
Monitoring for exploitation attempts within the sandbox is necessary

Technical summary

The CVE-2026-113110 vulnerability involves a memory corruption issue in Google Chrome's ShadowDOM feature. This could allow a remote attacker to execute arbitrary code within the sandbox by providing a crafted HTML page. The issue was addressed in Chrome version 156.0.8078.47. Defenders should prioritize patching vulnerable Chrome installations to prevent potential code execution within the sandbox. The vulnerability has a medium severity rating according to Chromium and was publicly disclosed on October 20, 2026. Affected product deployments should be identified and owners assigned for follow-up.

Defensive priority

Defenders should prioritize patching vulnerable Chrome installations to prevent potential code execution within the sandbox.

Recommended defensive actions

Patch Chrome installations to version 156.0.8078.47 or later
Review and update inventory of Chrome installations to ensure compliance
Monitor for potential exploitation attempts within the sandbox
Verify Chrome version in use and compare to the patched version
Check for any existing compensating controls that may mitigate exposure
Review relevant logs and monitoring for signs of exploitation
Track and document remediation progress and validation

Evidence notes

The CVE record and associated source item provide details on the vulnerability, including its existence in Chrome prior to version 156.0.8078.47 and the potential for remote code execution within the sandbox.

Sources and references

Verified primary and authoritative sources

CVE-2026-113110 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113110

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113110 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113110

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113110
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113110.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/553390794

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.