CVE-2026-113160 Google CVE debrief

Who should care

Google Chrome users, particularly those with high-risk exposure or requiring high security standards, should assess and update their Chrome versions to prevent potential exploitation.

Why it matters

CVE-2026-113160 is a high-severity use-after-free vulnerability in Google Chrome that allows remote attackers to execute arbitrary code inside the sandbox. Chrome users should verify and update to the latest version to prevent potential exploitation.

• Remote attackers may execute arbitrary code inside the sandbox
• Chrome users may be vulnerable to exploitation via crafted HTML pages
• Successful exploitation requires user interaction with a malicious HTML page

Technical summary

A use-after-free vulnerability in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This high-severity issue requires user interaction with a malicious HTML page. Chrome users should verify and update to the latest version to prevent potential exploitation. The vulnerability was publicly disclosed on 2026-10-20T21:01:57.087Z and has not been modified since then. The CVE record and NVD entry provide additional details on the vulnerability.

Defensive priority

High priority for Chrome users to verify and update to the latest version.

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Review and implement secure coding practices to prevent use-after-free vulnerabilities
• Monitor for suspicious activity and implement sandboxing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the use-after-free vulnerability in Turbolev in Google Chrome prior to 156.0.8078.47. The vulnerability allows remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. Chrome users should verify their version and update to 156.0.8078.47 or later. The CVE record was published on 2026-10-20T21:01:57.087Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.