PatchSiren cyber security CVE debrief

CVE-2026-113154 Google CVE debrief

Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. This High-severity vulnerability affects Google Chrome deployments, particularly those using versions prior to 156.0.8078.47. Defenders should assess exposure, verify inventory, and update Chrome to the latest version to mitigate potential risks. The vulnerability is confirmed by official CVE Program record and NIST NVD detail page.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for Google Chrome deployments, particularly those using versions prior to 156.0.8078.47, should assess exposure, verify inventory, and update to the latest version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and mitigate potential risks associated with this High-severity vulnerability.

Why it matters

CVE-2026-113154 is a High-severity memory corruption vulnerability in Google Chrome's Canvas component. Defenders should assess exposure, verify inventory, and update Chrome to version 156.0.8078.47 or later to mitigate potential risks.

Potential arbitrary code execution inside the sandbox
Exposure of Chrome versions prior to 156.0.8078.47
Need for inventory verification and updates
Monitoring for future Chrome releases

Technical summary

Memory corruption vulnerability in Canvas in Google Chrome prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the sandbox via crafted HTML pages. This High-severity vulnerability affects Google Chrome deployments, particularly those using versions prior to 156.0.8078.47. Defenders should assess exposure and update to the latest version to mitigate potential risks. The vulnerability is confirmed by official CVE Program record and NIST NVD detail page with High Chromium security severity.

Defensive priority

High

Recommended defensive actions

Assess exposure of Google Chrome versions prior to 156.0.8078.47
Verify inventory of Chrome deployments for version 156.0.8078.47 or later
Update Chrome to version 156.0.8078.47 or later
Monitor Chrome releases for future updates
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program record and NIST NVD detail page confirm memory corruption vulnerability in Google Chrome with High Chromium security severity. The CVE record was published on 2026-10-20T21:01:56.088Z. Defenders should verify Chrome versions prior to 156.0.8078.47 and update to the latest version. Evidence limits are based on source-provided information.

Sources and references

Verified primary and authoritative sources

CVE-2026-113154 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113154

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113154 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113154

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113154
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113154.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/569127861

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.