CVE-2026-113201 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updating to the latest version. This includes IT administrators, security teams, and vulnerability management teams who are responsible for ensuring the security of Google Chrome deployments. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs to

Why it matters

Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to prevent potential memory corruption in Google Chrome's Google Lens feature.

• Potential memory corruption in Google Chrome's Google Lens feature
• Remote attackers may attempt to read memory inside the sandbox
• Defenders should verify Chrome versions and update to prevent exploitation

Technical summary

The vulnerability is caused by a memory corruption issue in Google Chrome's Google Lens feature. An attacker can potentially read memory inside the sandbox via a crafted HTML page. The vulnerability has a low severity impact and is considered to be difficult to exploit. The issue is caused by a flaw in the way Google Chrome handles image recognition and analysis. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to prevent potential memory corruption. This can be achieved by reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to prevent potential memory corruption.

Recommended defensive actions

• Verify Chrome versions and update to 156.0.8078.47 or later
• Monitor Google Chrome for any suspicious activity
• Implement additional security measures to prevent potential memory corruption
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's Google Lens feature. The vulnerability was reported by an external researcher and is considered to have a low severity impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.