CVE-2026-113116 Google CVE debrief

Who should care

Google Chrome users, particularly those with DevTools enabled, should assess their exposure to this vulnerability and prioritize updating to version 156.0.8078.47 or later. IT administrators responsible for Chrome deployments should verify version numbers and apply updates as needed. Security teams should review DevTools usage and consider restricting access if not required for business operations. Users of Chrome's DevTools feature should be aware of the

Why it matters

CVE-2026-113116 is a use-after-free vulnerability in Google Chrome's DevTools that could allow remote code execution outside the sandbox. Defenders should prioritize verifying Chrome version 156.0.8078.47 or later and applying updates if necessary.

• Potential for remote code execution outside the sandbox
• Need for verification of Chrome version and application of updates
• Possible impact on DevTools usage and security

Technical summary

CVE-2026-113116 is a use-after-free vulnerability in DevTools in Google Chrome prior to version 156.0.8078.47. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability's impact is considered low by Chromium security severity standards. Defenders should focus on verifying Chrome version and applying updates to mitigate risks. The vulnerability affects Google Chrome's DevTools feature, which may be used by developers and advanced users. Users should assess their exposure and update to version 156.0.8078.47 or later.

Defensive priority

Defenders should prioritize verifying Chrome version 156.0.8078.47 or later and applying updates if necessary.

Recommended defensive actions

• Verify Chrome version and apply updates if necessary
• Monitor for suspicious activity
• Review DevTools usage and restrict access if needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about CVE-2026-113116. Google Chrome's stable channel update for desktop is referenced. Evidence is limited to publicly available records from CVE Program and NVD. Defenders should verify Chrome version 156.0.8078.47 or later and apply updates if necessary based on this information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.