PatchSiren cyber security CVE debrief

CVE-2026-113173 Google CVE debrief

CVE-2026-113173 debrief based on the supplied source corpus. The CVE record was published on 2026-10-20T21:02:46.499Z. Improper input validation in UI in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Defenders should verify Chrome versions, assess exposure, and prioritize updates. The Chromium security severity is listed as Low. This vulnerability affects Google Chrome on Android devices, particularly those in versions prior to 156.0.8078.47.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-21
Advisory published: 2026-10-20
Advisory updated: 2026-10-21

Who should care

Defenders responsible for managing Google Chrome on Android devices, especially those in versions prior to 156.0.8078.47, should assess exposure and prioritize updates. This includes verifying Chrome versions on Android devices, assessing exposure to potential arbitrary code execution within the sandbox, and updating Chrome to version 156.0.8078.47 or later.

Why it matters

CVE-2026-113173 is a Low-severity vulnerability in Google Chrome on Android prior to 156.0.8078.47, allowing potential arbitrary code execution within the sandbox. Defenders should verify Chrome versions, assess exposure, and prioritize updates.

Potential arbitrary code execution within the sandbox
Verification of Chrome versions on Android devices
Update priority for Chrome on Android

Technical summary

The vulnerability is caused by improper input validation in the UI of Google Chrome on Android prior to version 156.0.8078.47. This allows a remote attacker to potentially execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability affects Google Chrome on Android devices, particularly those in versions prior to 156.0.8078.47. The Chromium security severity is listed as Low. Defenders should prioritize verifying Chrome versions on Android devices, especially those prior to 156.0.8078.47, and assess exposure to potential arbitrary code execution within the sandbox.

Defensive priority

Defenders should prioritize verifying Chrome versions on Android devices, especially those prior to 156.0.8078.47, and assess exposure to potential arbitrary code execution within the sandbox.

Recommended defensive actions

Verify Chrome versions on Android devices, especially those prior to 156.0.8078.47
Assess exposure to potential arbitrary code execution within the sandbox
Update Chrome to version 156.0.8078.47 or later
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and source item provide details on the improper input validation vulnerability in Google Chrome on Android prior to 156.0.8078.47. The vulnerability allows a remote attacker to potentially execute arbitrary code within the sandbox via a crafted HTML page. Chromium security severity is listed as Low. The source item provides CVE details. Official CVE Program record with source-provided CVE metadata. Official NIST NVD detail page and source-specific vulnerability assessment.

Sources and references

Verified primary and authoritative sources

CVE-2026-113173 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113173

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113173 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113173

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113173
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113173.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/553274389

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.