CVE-2026-113137 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly those with Extensions enabled, should assess exposure and apply necessary patches. Users of Google Chrome, especially in environments where Extensions are used, should also be aware of this vulnerability and ensure their browser is up-to-date.

Why it matters

CVE-2026-113137 is a memory corruption vulnerability in Google Chrome's Extensions feature that allows a remote attacker to potentially read memory inside the sandbox. Defenders should prioritize verifying exposure and applying patches for Google Chrome versions prior to 156.0.8078.47, focusing on systems and users with Extensions enabled. The vulnerability's Medium severity level and potential for memory access emphasize the need for prompt attention and mitigation.

• Verify exposure and apply patches for Google Chrome versions prior to 156.0.8078.47
• Restrict user access to Extensions settings to limit potential attack surface
• Monitor for suspicious HTML page activity that may indicate exploitation attempts
• Assess and limit exposure for users with Extensions enabled

Technical summary

The vulnerability, CVE-2026-113137, is a memory corruption issue in Google Chrome's Extensions feature. It allows a remote attacker to potentially read memory inside the sandbox by providing a crafted HTML page. This issue was reported with a Medium severity level by the Chromium security team and affects Google Chrome versions prior to 156.0.8078.47. The vulnerability is related to the Extensions feature and can be mitigated by verifying exposure and applying patches for Google Chrome versions prior to 156.0.8078.47, focusing on systems and users with Extensions enabled.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Google Chrome versions prior to 156.0.8078.47, focusing on systems and users with Extensions enabled.

Recommended defensive actions

• Verify and apply Google Chrome updates to version 156.0.8078.47 or later
• Review and restrict user access to Extensions settings
• Monitor for suspicious HTML page activity
• Assess and limit exposure for users with Extensions enabled
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. The Chromium security team reported this issue with a Medium severity level. The CVE record was published on 2026-10-20T21:02:13.064Z and has not been modified since then. The source item provides additional information on the vulnerability, including affected versions and references to vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.