CVE-2026-113164 Google CVE debrief

Who should care

Android users and administrators using Google Chrome for browsing; IT teams responsible for maintaining Chrome deployments; Security teams monitoring for potential threats. Defenders should assess exposure, verify Chrome versions, and monitor for suspicious activity to mitigate potential threats. The vulnerability impacts Android deployments using Google Chrome, and defenders should prioritize updating Chrome to version 156.0.8078.47 or later on Android.

Why it matters

CVE-2026-113164 is a memory corruption vulnerability in Google Chrome on Android that allows remote attackers to execute arbitrary code inside the sandbox. Defenders should assess exposure, verify Chrome versions, and monitor for suspicious activity to mitigate potential threats.

• Remote attackers may execute arbitrary code inside the sandbox, potentially leading to unauthorized actions.
• Successful exploitation requires user interaction via a crafted HTML page.
• Defenders should prioritize updating Chrome to version 156.0.8078.47 or later on Android devices.
• Verify Chrome version and monitor for suspicious HTML pages to mitigate potential threats.

Technical summary

Memory corruption vulnerability in Voice component of Google Chrome on Android prior to version 156.0.8078.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability has a medium severity and defenders should assess exposure, verify Chrome versions, and monitor for suspicious activity to mitigate potential threats. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later on Android devices. Verify Chrome version and monitor for suspicious HTML pages to mitigate potential threats.

Defensive priority

High

Recommended defensive actions

• Assess exposure: Review Android deployments using Google Chrome for version 156.0.8078.47 or later.
• Verify version: Check Chrome version on Android devices and update to 156.0.8078.47 or later if necessary.
• Monitor for crafted HTML pages: Implement security measures to detect and block suspicious HTML pages.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Official CVE Program record and NIST NVD detail page confirm memory corruption vulnerability in Google Chrome on Android. Vendor release notes and Chromium issue tracker provide additional context. The CVE record was published on 2026-10-20T21:02:04.846Z and has not been modified since then. Defenders should verify Chrome version and monitor for suspicious HTML pages to mitigate potential threats. The vulnerability allows remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.