PatchSiren cyber security CVE debrief

CVE-2026-113147 Google CVE debrief

CVE-2026-113147 debrief based on CVE Program and NVD records. Google Chrome's WebShare feature has an improper input validation vulnerability prior to version 156.0.8078.47, which could allow a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is addressed in version 156.0.8078.47 or later. Defenders should assess exposure and prioritize updating to the latest version. The CVE Program and NVD records indicate a Medium severity vulnerability.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-22
Advisory published: 2026-10-20
Advisory updated: 2026-10-22

Who should care

Defenders responsible for Google Chrome deployments, particularly those using the WebShare feature, should assess exposure and prioritize updating to the latest version. Defenders should verify affected versions and exposure. The vulnerability affects Google Chrome's WebShare feature, allowing a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The CVE Program and NVD records indicate a Medium severity.

Why it matters

CVE-2026-113147 is a Medium severity vulnerability in Google Chrome's WebShare feature, which could allow remote attackers to execute arbitrary code inside the sandbox. Defenders should prioritize updating to version 156.0.8078.47 or later and monitor WebShare feature usage.

Potential remote code execution inside the sandbox
Requires verification of affected versions and exposure
Remediation priority for WebShare feature usage
Monitoring for crafted HTML page attacks

Technical summary

The CVE-2026-113147 vulnerability affects Google Chrome's WebShare feature, allowing a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is addressed in version 156.0.8078.47 or later. The CVE Program and NVD records indicate a Medium severity vulnerability. Defenders should prioritize updating to version 156.0.8078.47 or later and monitor WebShare feature usage. The vulnerability has a Medium severity and is addressed in the latest version of Google Chrome.

Defensive priority

Medium

Recommended defensive actions

Update Google Chrome to version 156.0.8078.47 or later
Review and monitor WebShare feature usage
Implement additional security measures for sandbox environments
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE Program and NVD records indicate a Medium severity vulnerability in Google Chrome's WebShare feature. The vulnerability is addressed in version 156.0.8078.47 or later. Defenders should verify affected versions and exposure. The CVE record was published on 2026-10-20T21:02:05.596Z and has not been modified since then. The vulnerability affects Google Chrome's WebShare feature, allowing a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

CVE-2026-113147 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113147

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113147 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113147

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113147
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113147.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/501531546

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.