CVE-2026-113149 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome installations, particularly in environments where exposure to untrusted HTML pages is possible, should assess their exposure and prioritize patching.

Why it matters

CVE-2026-113149 is a memory corruption vulnerability in Google Chrome's FullScreen feature that allows remote attackers to execute arbitrary code within the sandbox. Defenders should prioritize patching vulnerable Chrome installations to prevent potential code execution. The vulnerability's impact is limited to the sandbox environment, but verification of Chrome versions and monitoring for suspicious activity are necessary.

• Potential for remote code execution within the sandbox
• Need for verification of Chrome version and exposure to crafted HTML pages
• Priority for patching vulnerable Chrome installations
• Monitoring for suspicious activity related to this vulnerability

Technical summary

The vulnerability exists in the FullScreen feature of Google Chrome, allowing remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This issue was addressed in Chrome version 156.0.8078.47. The vulnerability's impact is limited to the sandbox environment, but verification of Chrome versions and monitoring for suspicious activity are necessary. Defenders should prioritize patching vulnerable Chrome installations to prevent potential code execution within the sandbox. The CVE record and source item provide details on the vulnerability, including its existence in Chrome versions prior to 156.0.8078.47.

Defensive priority

Defenders should prioritize patching vulnerable Chrome installations to prevent potential code execution within the sandbox.

Recommended defensive actions

• Patch Chrome installations to version 156.0.8078.47 or later
• Verify and update inventory of Chrome installations
• Monitor for suspicious HTML page activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Chrome versions prior to 156.0.8078.47 and the potential for remote code execution within the sandbox. The source details are limited, so defenders should verify Chrome versions and monitor for suspicious HTML page activity. No additional information is available on the scope of affected systems or potential exploits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.