PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113199 Google CVE debrief

CVE-2026-113199 debrief based on CVE Program and NVD records. Google Chrome users should assess exposure to this out-of-bounds read vulnerability. The vulnerability exists in the Payments component of Google Chrome prior to version 156.0.8078.47. This vulnerability could allow a remote attacker to read memory inside the sandbox via a crafted HTML page. Chrome users should assess exposure and update to the latest version. The CVE record and NVD entry provide details on the out-of-bounds read vulnerability in Google Chrome prior to 156.0.8078.47.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-21
Advisory published
2026-10-20
Advisory updated
2026-10-21

Who should care

Google Chrome users, particularly those in environments where Chrome is used for browsing or payments processing, should assess their exposure to this vulnerability and prioritize remediation.

Why it matters

CVE-2026-113199 is a medium-severity vulnerability in Google Chrome that could allow remote attackers to read memory inside the sandbox. Chrome users should assess exposure and update to the latest version.

  • Verify Chrome version and update to 156.0.8078.47 or later to prevent potential memory reads.
  • Assess exposure of Chrome deployments to this vulnerability.
  • Prioritize remediation for Chrome environments used for sensitive transactions or browsing.

Technical summary

An out-of-bounds read vulnerability exists in the Payments component of Google Chrome prior to version 156.0.8078.47. This vulnerability could allow a remote attacker to read memory inside the sandbox via a crafted HTML page. The vulnerability was addressed in Chrome version 156.0.8078.47. Chrome users should assess exposure and update to the latest version. The CVE Program and NVD records provide source-provided CVE metadata and official vulnerability assessment. The vulnerability has a medium severity and is addressed in the latest Chrome version.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the Chrome update to version 156.0.8078.47 or later.
  • Assess exposure and prioritize remediation for affected Chrome deployments.
  • Verify that Chrome is updated to the latest version in your environment.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the out-of-bounds read vulnerability in Google Chrome prior to 156.0.8078.47. The vulnerability exists in the Payments component of Google Chrome. This vulnerability could allow a remote attacker to read memory inside the sandbox via a crafted HTML page. Chrome users should assess exposure and update to the latest version. The CVE Program and NVD records provide source-provided CVE metadata and official vulnerability assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113199 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113199

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113199 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113199

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113199

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113199.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/562226316

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.