CVE-2026-113205 Google CVE debrief

Who should care

Chrome users and administrators should verify their version and update to 156.0.8078.47 or later to mitigate this vulnerability. This includes IT teams managing Chrome deployments, security teams monitoring for potential threats, and individual users ensuring their browser is up-to-date. The vulnerability's medium severity and potential for remote code execution within the sandbox make it important for those relying on Chrome for daily operations or using

Why it matters

CVE-2026-113205 is a use-after-free vulnerability in Google Chrome's Variations feature that allows remote attackers to execute arbitrary code within the sandbox. Chrome users should verify their version and update to 156.0.8078.47 or later to mitigate this vulnerability.

• Remote code execution within the sandbox
• Potential for crafted HTML page attacks
• Medium severity classification by Chromium

Technical summary

A use-after-free vulnerability in Google Chrome's Variations feature prior to version 156.0.8078.47 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This issue was classified as Medium severity by Chromium and patched in the stable channel update. The vulnerability allows for code execution within the sandbox, limiting potential damage but still posing a risk due to the potential for crafted HTML page attacks. Chrome users and administrators should verify their version and update to 156.0.8078.47 or later to mitigate this vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Monitor Chrome releases for future security updates
• Implement sandboxing and isolation for Chrome instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and Chromium security bulletin provide details on the use-after-free vulnerability in Google Chrome's Variations feature. The issue was patched in the stable channel update. Evidence is limited to public sources and may not reflect the full scope or impact. Defenders should verify Chrome version and update to 156.0.8078.47 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.