CVE-2026-113134 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly on Windows systems, should assess exposure and prioritize updating to the latest version. This includes IT teams managing Chrome installations in their organizations, security teams monitoring for potential vulnerabilities, and administrators responsible for maintaining system updates. These stakeholders should verify Chrome versions and implement updates to prevent potential remote

Why it matters

CVE-2026-113134 is a memory corruption vulnerability in ANGLE in Google Chrome on Windows prior to 156.0.8078.47. Defenders should prioritize verifying Chrome versions and updating to the latest version to prevent potential remote code execution inside the sandbox.

• Potential for remote code execution inside the sandbox
• Need for verification of Chrome versions and updates
• Possible impact on systems with outdated Chrome versions

Technical summary

Memory corruption in ANGLE in Google Chrome on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has a high severity rating according to Chromium security severity standards. The issue is addressed in Chrome version 156.0.8078.47 or later. Defenders should prioritize verifying Chrome versions and updating to the latest version to prevent potential remote code execution inside the sandbox. The vulnerability is related to ANGLE, and defenders should review and implement secure coding practices for ANGLE.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later.

Recommended defensive actions

• Verify Chrome versions and update to 156.0.8078.47 or later
• Review and implement secure coding practices for ANGLE
• Monitor for suspicious activity related to crafted HTML pages
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in ANGLE in Google Chrome on Windows prior to 156.0.8078.47. The vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Defenders should verify Chrome versions and update to the latest version. The source details are limited, and explicit evidence-limit language should be considered.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.