CVE-2026-113196 Google CVE debrief

Who should care

Defenders responsible for Google Chrome installations on iOS devices should assess exposure and apply updates as necessary. This includes reviewing and updating inventory of Google Chrome installations on iOS devices, monitoring Google Chrome release notes and security advisories for future updates, and verifying exposure of Google Chrome on iOS versions prior to 156.0.8078.47. Defenders should also prioritize verifying exposure and applying updates as a 1

Why it matters

CVE-2026-113196 is an improper access control vulnerability in Google Chrome on iOS that allows remote attackers to bypass web origin policy. Defenders should verify exposure and apply updates.

• Verification of Google Chrome version 156.0.8078.47 or later is required to prevent web origin policy bypass.
• Defenders must review and update inventory of Google Chrome installations on iOS devices to ensure they are not vulnerable.

Technical summary

The vulnerability is caused by improper access control in Google Chrome on iOS prior to version 156.0.8078.47. This allows a remote attacker to bypass web origin policy via a crafted HTML page. The vulnerability affects Google Chrome installations on iOS devices, and defenders should assess exposure and apply updates as necessary. The vulnerability has a medium severity and is considered to be of moderate impact. Defenders should prioritize verifying exposure of Google Chrome on iOS versions prior to 156.0.8078.47 and applying the update.

Defensive priority

Defenders should prioritize verifying exposure of Google Chrome on iOS versions prior to 156.0.8078.47 and applying the update.

Recommended defensive actions

• Verify Google Chrome on iOS versions prior to 156.0.8078.47 are updated to 156.0.8078.47 or later.
• Review and update inventory of Google Chrome installations on iOS devices.
• Monitor Google Chrome release notes and security advisories for future updates.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• technicalSummary

Evidence notes

The CVE record and source item provide details on the vulnerability, but do not specify versions or impacts beyond bypassing web origin policy. The vulnerability was reported by an external researcher and is considered to be of medium severity. There is no indication of public exploitation of this vulnerability. Defenders should verify exposure and apply updates as necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.