CVE-2026-113189 Google CVE debrief

Who should care

Google Chrome users, particularly those with versions prior to 156.0.8078.47, should assess exposure and update to the latest version. Chrome users should verify their version and update to the latest version to prevent potential security breaches. Security teams and administrators should review the CVE record and NVD entry for details on the vulnerability and implement necessary security measures.

Why it matters

CVE-2026-113189 is a use-after-free vulnerability in Google Chrome that allows remote attackers to execute arbitrary code outside the sandbox. Chrome users, especially those with versions prior to 156.0.8078.47, should verify their version and update to the latest to prevent potential security breaches.

• Remote code execution outside the sandbox
• Potential for arbitrary code execution
• Need for version verification and updates
• Possible security bypass via crafted HTML pages

Technical summary

A use-after-free vulnerability in the Core component of Google Chrome prior to version 156.0.8078.47 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability can be exploited by a remote attacker to execute arbitrary code outside the sandbox. Chrome users should verify their version and update to the latest version to prevent potential security breaches. The vulnerability is caused by a use-after-free error in the Core component of Google Chrome. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

High priority for Chrome users to verify and update to the latest version.

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Review and implement secure coding practices to prevent use-after-free vulnerabilities
• Monitor for suspicious activity and implement additional security measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the use-after-free vulnerability in Google Chrome prior to version 156.0.8078.47. The vulnerability allows remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page. Chrome users should verify their version and update to the latest version. The CVE record was published on 2026-10-20T21:02:13.836Z and has not been modified since then. Evidence is limited to CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.