CVE-2026-113187 Google CVE debrief

Who should care

Google Chrome users, particularly those with versions prior to 156.0.8078.47, should assess exposure and verify if systems are running the latest version of Google Chrome. Security teams should prioritize updates, monitor for exploitation attempts, and review compensating controls for exposed systems.

Why it matters

CVE-2026-113187 is a use-after-free vulnerability in Google Chrome's DOM, allowing remote attackers to execute arbitrary code inside the sandbox. Defenders should assess exposure, prioritize updates, and monitor for exploitation attempts.

• Remote attackers may attempt to execute arbitrary code inside the sandbox
• Successful exploitation could lead to code execution within the sandbox
• Defenders should prioritize updating Google Chrome to version 156.0.8078.47 or later
• Exposure verification and monitoring for potential exploitation attempts are necessary

Technical summary

A use-after-free vulnerability exists in the DOM of Google Chrome prior to version 156.0.8078.47. This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was publicly disclosed on 2026-10-20T21:02:27.390Z and has not been modified since then. Defenders should prioritize updating Google Chrome to version 156.0.8078.47 or later and monitor for potential exploitation attempts within sandbox limitations of Google Chrome's security model and architecture.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure to Google Chrome version 156.0.8078.47 and earlier
• Verify if systems are running the latest version of Google Chrome
• Update Google Chrome to version 156.0.8078.47 or later
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on a use-after-free vulnerability in Google Chrome prior to version 156.0.8078.47. The vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Defenders should assess exposure, prioritize updates, and monitor for exploitation attempts. Evidence is limited to CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.