PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113145 Google CVE debrief

A memory corruption vulnerability in Google Chrome's Messages feature on Android prior to version 156.0.8078.47 could potentially allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The Chromium security team rated this issue as Low severity. Defenders should assess exposure and prioritize updates to prevent potential code execution within the sandbox. This vulnerability affects Android devices using Google Chrome's Messages feature, and defenders should verify Android Chrome versions to prevent exploitation.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-21
Advisory published
2026-10-20
Advisory updated
2026-10-21

Who should care

Defenders responsible for managing Google Chrome deployments on Android devices should assess exposure and prioritize updates to prevent potential code execution within the sandbox.

Why it matters

A memory corruption vulnerability in Google Chrome's Messages feature on Android prior to version 156.0.8078.47 could potentially allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. Defenders should prioritize verifying Android Chrome versions and applying updates to prevent potential code execution within the sandbox.

  • Potential code execution within the sandbox requires verification and mitigation.
  • Defenders must verify Android Chrome versions to prevent exploitation.
  • Applying updates is crucial to prevent potential damage.

Technical summary

The vulnerability is a memory corruption issue in Google Chrome's Messages feature on Android, which could potentially allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. This issue was rated as Low severity by the Chromium security team. The vulnerability affects Android devices using Google Chrome's Messages feature prior to version 156.0.8078.47. Defenders should prioritize verifying Android Chrome versions and applying updates to prevent potential code execution within the sandbox.

Defensive priority

Defenders should prioritize verifying Android Chrome versions and applying updates to prevent potential code execution within the sandbox.

Recommended defensive actions

  • Verify Android Chrome versions and apply updates to prevent potential code execution within the sandbox.
  • Monitor Google Chrome security advisories for future updates and patches.
  • Implement sandboxing and isolation measures to limit potential damage.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and Chromium security bulletin provide official details on the vulnerability. However, specific impact and exploitation details are limited. Defenders should verify Android Chrome versions and review official advisories for further information. The CVE Program record and NIST NVD detail page offer additional context on the vulnerability. Supplemental source references may provide further insights into affected systems and potential mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113145 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113145

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113145 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113145

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113145

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113145.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/553169805

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.