CVE-2026-113197 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly in environments where user input is not strictly controlled, should assess exposure and prioritize updating to the latest version.

Why it matters

CVE-2026-113197 is a medium-severity use-after-free vulnerability in Google Chrome's Forms component. Defenders should care because it allows remote attackers to execute arbitrary code within the sandbox, potentially leading to security breaches. Roles responsible for Chrome deployments should assess exposure, prioritize updates to version 156.0.8078.47 or later, and monitor for potential crafted HTML page attacks.

• Remote code execution within the sandbox
• Potential for crafted HTML page attacks
• Requires verification of affected versions and remediation

Technical summary

The CVE-2026-113197 vulnerability is a use-after-free issue in Google Chrome's Forms component. This allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability was publicly disclosed on October 20, 2026, and affects Google Chrome versions prior to 156.0.8078.47. The vulnerability has a medium severity and defenders should prioritize updating to the latest version to mitigate potential security breaches. The official CVE Program record and NIST NVD detail page provide additional information on the vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review and monitor HTML page inputs for potential crafted attacks
• Implement sandboxing and isolation for critical systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. The vulnerability is a use-after-free issue in Google Chrome's Forms component, allowing remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The official CVE Program record and NIST NVD detail page provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.