CVE-2026-113183 Google CVE debrief

Who should care

Defenders responsible for Google Chrome deployments, particularly those managing sandboxing configurations and assessing exposure to potential code execution, should prioritize updates and verify configurations to mitigate operational impacts. This includes IT teams managing Chrome installations, security teams monitoring for suspicious activity, and operators responsible for ensuring the integrity of Chrome-based systems.

Why it matters

CVE-2026-113183 is a memory corruption vulnerability in Google Chrome's FedCM that could allow arbitrary code execution inside the sandbox. Defenders should prioritize updates and verify sandboxing configurations.

• Potential arbitrary code execution inside the sandbox
• Memory corruption vulnerability in FedCM
• Verification of sandboxing configurations required

Technical summary

Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability affects Google Chrome deployments and requires defenders to assess exposure, prioritize updates, and verify sandboxing configurations to mitigate potential impacts. Technical details are limited to publicly available information from official sources, and defenders should focus on updating and verifying configurations rather than attempting to exploit or reverse-engineer the vulnerability.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review and verify sandboxing configurations
• Monitor for suspicious HTML page activity
• Confirm whether affected Google Chrome deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program record and NIST NVD detail page confirm memory corruption vulnerability in Google Chrome. Chromium security severity is Medium. Evidence is limited to publicly available details from these sources, and defenders should verify sandboxing configurations and assess exposure based on this information. Additional verification tasks are recommended to ensure accurate understanding of potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.