CVE-2026-113153 Google CVE debrief

Who should care

Defenders managing Chrome deployments, especially in environments with remote access or exposure to untrusted web content, should assess exposure and prioritize updating to Chrome 156.0.8078.47 or later.

Why it matters

CVE-2026-113153 is a medium-severity memory corruption vulnerability in Google Chrome's SiteIsolation feature. Defenders managing Chrome deployments should assess exposure, especially in environments with remote access or untrusted web content, and prioritize updating to Chrome 156.0.8078.47 or later.

• Potential for remote code execution within the sandbox
• Need for verification of Chrome version and exposure
• Priority for updating to Chrome 156.0.8078.47 or later
• Monitoring for potential exploitation attempts

Technical summary

Google Chrome prior to 156.0.8078.47 had a memory corruption vulnerability in SiteIsolation (CVE-2026-113153). This medium-severity issue could potentially allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability affects Chrome's SiteIsolation feature, which is designed to provide an additional layer of security. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later. They should also assess exposure for Chrome deployments, especially in environments where remote access or untrusted web content is common.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later. Assess exposure for Chrome deployments, especially in environments where remote access or untrusted web content is common.

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Assess exposure for Chrome deployments, especially in environments with remote access or untrusted web content
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE and NVD records provide details on the vulnerability in Google Chrome's SiteIsolation feature. Chromium rates this vulnerability as medium severity. The CVE was published on 2026-10-20T21:02:30.563Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.