PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113131 Google CVE debrief

A memory corruption vulnerability in Google Chrome's Bluetooth component, prior to version 156.0.8078.47, could allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. This issue, tracked as CVE-2026-113131, was publicly disclosed on October 20, 2026. The vulnerability affects Google Chrome deployments and requires immediate attention from IT and security teams to assess exposure and prioritize remediation. This includes reviewing current Chrome versions, updating to patched versions, and ensuring proper sandboxing configurations. The CVE record and source item provide details on the vulnerability, including its existence in Chrome versions 156

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

IT and security teams responsible for managing Google Chrome deployments should assess exposure and prioritize remediation. This includes reviewing current Chrome versions, updating to patched versions, and ensuring proper sandboxing configurations.

Why it matters

CVE-2026-113131 is a memory corruption vulnerability in Google Chrome's Bluetooth component that allows remote code execution within the sandbox. Defenders should prioritize patching vulnerable installations to prevent potential attacks. This requires immediate attention from IT and security teams managing browser updates.

  • Potential remote code execution within the sandbox
  • Need for immediate patching of vulnerable Chrome installations
  • Importance of verifying Chrome version and configurations
  • Potential for exploitation via crafted HTML pages

Technical summary

CVE-2026-113131 is a memory corruption vulnerability in Google Chrome's Bluetooth component. It allows a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability was publicly disclosed on October 20, 2026, and patched in Chrome version 156.0.8078.47. The issue affects Google Chrome's Bluetooth component and requires patching vulnerable installations to prevent potential code execution attacks. This requires immediate attention from IT and security teams responsible for managing browser updates to ensure proper sandboxing configurations and verify Chrome version and update if necessary.

Defensive priority

Defenders should prioritize patching vulnerable Chrome installations to prevent potential code execution attacks. This requires immediate attention from IT and security teams responsible for managing browser updates.

Recommended defensive actions

  • Patch Chrome installations to version 156.0.8078.47 or later
  • Review and update browser configurations to ensure sandboxing is enabled
  • Monitor for suspicious HTML page activity
  • Verify Chrome version and update if necessary
  • Assess exposure and prioritize remediation for vulnerable deployments

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Chrome versions prior to 156.0.8078.47 and the potential for remote code execution. However, specific details about exploitation are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113131 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113131

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113131 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113131

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113131

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113131.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/500536121

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.