CVE-2026-113135 Google CVE debrief

Who should care

Defenders responsible for Google Chrome deployments should assess exposure and prioritize updates. This includes reviewing and monitoring HTML page inputs for potential crafted attacks and implementing sandboxing and isolation measures. Additionally, defenders should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

Defenders should prioritize updating Google Chrome to prevent potential memory corruption attacks. The vulnerability allows remote attackers to execute arbitrary code inside the sandbox, posing a high severity risk. Chrome deployments should review and monitor HTML page inputs for potential crafted attacks and implement sandboxing and isolation measures.

• Potential arbitrary code execution inside the sandbox
• Remote attack vector via crafted HTML page
• High severity vulnerability in widely used browser

Technical summary

Memory corruption in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is related to the browser's handling of HTML pages, which can lead to potential arbitrary code execution inside the sandbox. This issue poses a high severity risk, particularly for defenders responsible for Google Chrome deployments. Chrome deployments should review and monitor HTML page inputs for potential crafted attacks and implement sandboxing and isolation measures.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review and monitor HTML page inputs for potential crafted attacks
• Implement sandboxing and isolation measures for Chrome
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program record and NIST NVD detail page provide information on the memory corruption vulnerability in Google Chrome. The CVE record was published on 2026-10-20T21:01:51.600Z and has not been modified since then. The official advisory from Google Chrome notes that the stable channel has been updated to version 156.0.8078.47, which addresses this vulnerability. The vulnerability is identified as a high severity issue, and defenders should prioritize updating Google Chrome to prevent potential memory corruption attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.