CVE-2026-113144 Google CVE debrief

Who should care

Defenders responsible for Google Chrome deployments should assess exposure and apply patches for versions prior to 156.0.8078.47. This includes reviewing compensating controls for exposed systems, checking relevant monitoring, detection, and logs for exposed assets, and tracking exceptions and retesting remediated assets. Additionally, defenders should confirm whether affected product deployments exist in managed environments and assign an owner for follow

Why it matters

CVE-2026-113144 is a memory corruption vulnerability in Google Chrome's Speech feature that allows remote attackers to read memory inside the sandbox. Defenders should prioritize assessing exposure and applying patches for Google Chrome versions prior to 156.0.8078.47.

• Read memory inside the sandbox
• Assess exposure of Google Chrome versions prior to 156.0.8078.47
• Apply patches for Google Chrome version 156.0.8078.47 or later

Technical summary

The CVE-2026-113144 vulnerability is a memory corruption issue in Google Chrome's Speech feature. This vulnerability allows remote attackers to read memory inside the sandbox via a crafted HTML page. The issue was publicly disclosed on October 20, 2026, and last modified on October 21, 2026. The vulnerability has a Medium severity rating according to Chromium. The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's Speech feature. Defenders should prioritize assessing exposure and applying patches for Google Chrome versions prior to 156.0.8078.47.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Google Chrome versions prior to 156.0.8078.47, as this vulnerability allows remote attackers to read memory inside the sandbox.

Recommended defensive actions

• Assess exposure of Google Chrome versions prior to 156.0.8078.47
• Apply patches for Google Chrome version 156.0.8078.47 or later
• Monitor Google Chrome for updates and apply patches as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's Speech feature. The Chromium security severity is rated as Medium. The vulnerability allows remote attackers to read memory inside the sandbox via a crafted HTML page. The issue was publicly disclosed on October 20, 2026, and last modified on October 21, 2026. There are no known exploits or attacks in the wild. The CVE Program and NIST NVD provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.