PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113190 Google CVE debrief

CVE-2026-113190 is a use-after-free vulnerability in the ServiceWorker of Google Chrome prior to version 156.0.8078.47. This vulnerability could allow a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The severity of this issue is considered Medium by the Chromium security team. Affected product deployments should be assessed for exposure, especially those handling HTML pages from untrusted sources. Necessary patches or mitigations should be applied promptly to prevent potential exploitation.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for managing Google Chrome deployments, especially those handling HTML pages from untrusted sources, should assess their exposure to this vulnerability and apply necessary patches or mitigations.

Why it matters

CVE-2026-113190 is a Medium-severity use-after-free vulnerability in Google Chrome's ServiceWorker that could allow arbitrary code execution within the sandbox. Defenders should assess exposure, especially for systems handling untrusted HTML sources, and apply patches or mitigations.

  • Potential for arbitrary code execution within the sandbox
  • Exposure to crafted HTML pages from untrusted sources
  • Need for Chrome version updates to 156.0.8078.47 or later
  • Verification of sandboxing configurations

Technical summary

The CVE-2026-113190 vulnerability is a use-after-free issue in the ServiceWorker component of Google Chrome. This vulnerability can be exploited by a remote attacker through a crafted HTML page, potentially allowing arbitrary code execution within the sandbox. The Chromium security team has rated this issue as Medium severity. The vulnerability affects Google Chrome versions prior to 156.0.8078.47. Defenders should prioritize assessing exposure and applying patches for this vulnerability, especially for systems and users that handle HTML pages from untrusted sources.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for this vulnerability, especially for systems and users that handle HTML pages from untrusted sources.

Recommended defensive actions

  • Assess exposure of Chrome deployments to untrusted HTML sources
  • Verify and apply Chrome updates to version 156.0.8078.47 or later
  • Monitor for suspicious HTML page activity
  • Review and update sandboxing configurations for Chrome
  • Perform vulnerability scanning to identify potentially exposed assets
  • Implement compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions and retest remediated assets to ensure successful mitigation

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. The vulnerability is a use-after-free issue in the ServiceWorker component of Google Chrome. The CVE record was published on 2026-10-20T21:02:15.565Z and has not been modified since then. The official CVE Program record and NIST NVD detail page offer additional information on the vulnerability. Defenders should verify the affected scope and vendor guidance to plan

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113190 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113190

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113190 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113190

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113190

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113190.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/514372708

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.