PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113203 Google CVE debrief

CVE-2026-113203 debrief based on CVE Program and NVD records. Google Chrome versions prior to 156.0.8078.47 are affected by a use-after-free vulnerability in CSS, which could allow remote attackers to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is considered Medium severity by Chromium. Defenders and administrators should assess exposure and prioritize updates to prevent potential exploitation. This vulnerability was reported by external researchers and patched by Google.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders and administrators responsible for Google Chrome installations should assess exposure and prioritize updates to prevent potential exploitation. This includes reviewing and monitoring Google Chrome versions for compliance, implementing sandboxing and isolation measures for critical systems, and verifying versions for compliance.

Why it matters

CVE-2026-113203 is a use-after-free vulnerability in CSS in Google Chrome prior to 156.0.8078.47, which could allow remote attackers to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Defenders and administrators responsible for Google Chrome installations should assess exposure and prioritize updates to prevent potential exploitation.

  • Potential execution of arbitrary code inside the sandbox
  • Required verification of Google Chrome versions for compliance
  • Implementation of sandboxing and isolation measures for critical systems

Technical summary

A use-after-free vulnerability in CSS in Google Chrome prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is considered Medium severity by Chromium and was patched in version 156.0.8078.47. Defenders should prioritize updates to prevent potential exploitation. This vulnerability was reported by external researchers and patched by Google in the stable channel update. The CVE record was published on 2026-10-20T21:02:33.085Z.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 156.0.8078.47 or later
  • Review and monitor Google Chrome versions for compliance
  • Implement sandboxing and isolation measures for critical systems
  • Confirm whether affected Google Chrome deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, including its description and affected versions. Evidence is limited to public CVE and NVD records. Defenders should verify Google Chrome versions for compliance and implement sandboxing measures for critical systems. The vulnerability was patched in Google Chrome version 156.0.8078.47.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113203 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113203

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113203 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113203

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113203

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113203.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/562230438

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.