PatchSiren cyber security CVE debrief

CVE-2026-113169 Google CVE debrief

CVE-2026-113169 debrief based on CVE Program and NVD records. Google Chrome on Android prior to 156.0.8078.47 had a memory corruption vulnerability in WebAppInstalls, which could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability was reported by an external researcher and patched by Google. The patch was part of a stable channel update. Users should review the official advisory for affected scope and severity. Defenders should assess exposure and prioritize updates to prevent potential code execution.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-22
Advisory published: 2026-10-20
Advisory updated: 2026-10-22

Who should care

Defenders responsible for managing Google Chrome installations on Android systems should assess exposure and prioritize updates to prevent potential code execution. This includes IT teams managing Chrome deployments in enterprise environments, as well as individual users who rely on Chrome for Android. Security teams should review the official advisory and CVE record to validate affected scope and severity. Vulnerability management processes should include

Why it matters

CVE-2026-113169 is a memory corruption vulnerability in Google Chrome's WebAppInstalls on Android that could allow remote code execution. Defenders should prioritize updates to prevent potential code execution.

Remote code execution outside the sandbox
Potential for arbitrary code execution via crafted HTML pages
Requires updating Google Chrome to version 156.0.8078.47 or later

Technical summary

The CVE record describes a memory corruption vulnerability in WebAppInstalls in Google Chrome on Android prior to 156.0.8078.47. The vulnerability could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This issue was patched by Google as part of a stable channel update. Defenders should prioritize updating Google Chrome to version 156.0.8078.47 or later on Android systems to prevent potential code execution. The patch addresses the vulnerability by correcting how WebAppInstalls handles certain inputs.

Defensive priority

Defenders should prioritize updating Google Chrome to version 156.0.8078.47 or later on Android systems to prevent potential code execution.

Recommended defensive actions

Update Google Chrome to version 156.0.8078.47 or later on Android systems
Monitor Google Chrome for updates and apply them promptly
Restrict access to untrusted HTML pages
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the memory corruption vulnerability in Google Chrome's WebAppInstalls on Android. The vulnerability was reported by an external researcher and patched by Google.

Sources and references

Verified primary and authoritative sources

CVE-2026-113169 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113169

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113169 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113169

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113169
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113169.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/562955271

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.