PatchSiren cyber security CVE debrief

CVE-2026-113166 Google CVE debrief

PatchSiren debrief for CVE-2026-113166: Memory corruption in History in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This issue has a Medium security severity according to Chromium. Defenders should assess exposure, apply patches, and monitor for potential sandbox bypass attempts. Incident response teams should review plans for code execution scenarios. The CVE record was published on 2026-10-20T21:02:08.899Z and has not been modified since then.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for Google Chrome on Android deployments should assess exposure and apply patches. Incident response teams should review plans for potential code execution scenarios.

Why it matters

CVE-2026-113166 is a memory corruption vulnerability in Google Chrome on Android that allows remote code execution inside the sandbox. Defenders should assess exposure, apply patches, and monitor for potential sandbox bypass attempts. Incident response teams should review plans for code execution scenarios.

Remote code execution inside the sandbox requires verification
Potential sandbox bypass attempts need monitoring
Patching to version 156.0.8078.47 or later is recommended
Incident response plans should account for code execution scenarios

Technical summary

Memory corruption vulnerability in Google Chrome on Android prior to 156.0.8078.47 allows remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. This issue has a Medium security severity according to Chromium. The CVE record was published on 2026-10-20T21:02:08.899Z and has not been modified since then. Defenders should assess exposure and apply patches. Incident response teams should review plans for code execution scenarios. Monitoring for potential sandbox bypass attempts is recommended.

Defensive priority

High

Recommended defensive actions

Assess exposure of Google Chrome on Android versions prior to 156.0.8078.47
Verify and apply the patched version 156.0.8078.47 or later
Monitor for potential sandbox bypass attempts
Review and update incident response plans for potential code execution scenarios
Track exceptions and retest remediated assets
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Official CVE Program record and NIST NVD detail page confirm memory corruption vulnerability in Google Chrome on Android. Chromium security severity is Medium. The CVE record was published on 2026-10-20T21:02:08.899Z and has not been modified since then. Defenders should verify and apply the patched version 156.0.8078.47 or later. Monitoring for potential sandbox bypass attempts is recommended.

Sources and references

Verified primary and authoritative sources

CVE-2026-113166 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113166

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113166 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113166

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113166
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113166.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/504073211

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.