PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113210 Google CVE debrief

CVE-2026-113210 debrief based on CVE Program and NVD records. Google Chrome users on Windows should assess exposure to a use-after-free vulnerability in ANGLE, which could allow remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. This vulnerability, identified as CVE-2026-113210, exists in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome on Windows. The issue was addressed in Google Chrome version 156.0.8078.47. Google Chrome users on Windows, particularly those with exposure to untrusted or potentially malicious HTML content, should assess their exposure to this vulnerability and update to the latest version of Chrome to mitigate  

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-21
Advisory published
2026-10-20
Advisory updated
2026-10-21

Who should care

Google Chrome users on Windows, particularly those with exposure to untrusted or potentially malicious HTML content, should assess their exposure to this vulnerability and update to the latest version of Chrome to mitigate potential risks.

Why it matters

CVE-2026-113210 is a high-severity use-after-free vulnerability in ANGLE, part of Google Chrome on Windows. It allows remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. Google Chrome users on Windows, especially those exposed to untrusted content, should assess their exposure and update to version 156.0.8078.47 or later. The vulnerability's impact is somewhat mitigated by the sandbox, but exploitation could still lead to significant consequences. Evidence from official sources supports the vulnerability's existence and provides details for remediation.

  • Remote code execution inside the sandbox, potentially bypassing some security controls.
  • Possible exploitation via crafted HTML pages, which could be distributed through various channels.
  • Requires verification of affected versions and exposure in specific deployment contexts.
  • Remediation involves updating Google Chrome to version 156.0.8078.47 or later.

Technical summary

A use-after-free vulnerability exists in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome on Windows. This vulnerability, identified as CVE-2026-113210, allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The issue was addressed in Google Chrome version 156.0.8078.47. The vulnerability's impact is somewhat mitigated by the sandbox, but exploitation could still lead to significant consequences. Evidence from official sources supports the vulnerability's existence and provides details for remediation.

Defensive priority

High

Recommended defensive actions

  • Assess exposure to CVE-2026-113210 for Google Chrome on Windows, focusing on versions prior to 156.0.8078.47.
  • Update Google Chrome to version 156.0.8078.47 or later.
  • Monitor for potential exploitation attempts targeting this vulnerability.
  • Review and enforce sandboxing and isolation controls for Chrome.
  • Perform vulnerability scanning to identify exposed assets.
  • Review system logs for indicators of compromise related to this vulnerability.
  • Implement additional security controls for high-risk deployments.

Evidence notes

The CVE record and NVD entry provide details on a use-after-free vulnerability in ANGLE, part of Google Chrome on Windows. The vulnerability is described as having a high severity by Chromium. Affected versions are prior to 156.0.8078.47.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113210 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113210

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113210 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113210

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113210

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113210.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/563354824

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.