CVE-2026-113115 Google CVE debrief

Who should care

Chrome users, particularly those with critical systems or sensitive data, should verify their version and update to 156.0.8078.47 or later to mitigate this vulnerability. IT administrators and security teams responsible for Chrome deployments should prioritize this update.

Why it matters

CVE-2026-113115 is a use-after-free vulnerability in Google Chrome's Transactions Platform that allows remote attackers to execute arbitrary code within the sandbox. Chrome users should update to version 156.0.8078.47 or later to mitigate this Medium-severity issue.

• Remote code execution within the sandbox
• Potential for crafted HTML page attacks
• Medium severity classification by Chromium

Technical summary

A use-after-free vulnerability exists in Google Chrome's Transactions Platform prior to version 156.0.8078.47. This allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The issue is classified as Medium severity by Chromium and was patched in a stable channel update. Chrome users should verify their version and update to 156.0.8078.47 or later to mitigate this vulnerability. IT administrators and security teams should prioritize this update and review compensating controls for exposed systems.

Defensive priority

Medium

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Monitor Chrome releases for future security updates
• Implement sandboxing and isolation for critical systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and Chromium security bulletin provide details on the use-after-free vulnerability in Google Chrome's Transactions Platform. The stable channel update for desktop was released on October 20, 2026.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.