CVE-2026-113211 Google CVE debrief

Who should care

Defenders of Google Chrome deployments should assess exposure and verify Chrome version to prevent potential arbitrary code execution outside the sandbox. This includes IT teams responsible for Chrome management, security teams monitoring for potential threats, and operators of Chrome-based systems. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later and monitor for potential arbitrary code execution attempts outside the sandbox.

Why it matters

CVE-2026-113211 is a memory corruption vulnerability in Google Chrome ServiceWorker that allows potential arbitrary code execution outside the sandbox. Defenders of Google Chrome deployments should assess exposure and verify Chrome version to prevent potential exploitation.

• Potential arbitrary code execution outside the sandbox requires verification
• Defenders must assess exposure of Google Chrome ServiceWorker to crafted HTML pages
• Chrome version verification is necessary to prevent exploitation

Technical summary

Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is caused by improper memory management in the ServiceWorker component, which can be exploited through crafted HTML pages. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later and monitor for potential arbitrary code execution attempts outside the sandbox. The vulnerability has been assessed as Medium severity by Chromium.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure of Google Chrome ServiceWorker to crafted HTML pages
• Verify Chrome version is 156.0.8078.47 or later
• Monitor for potential arbitrary code execution attempts outside the sandbox
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program record and NIST NVD detail page provide information on the memory corruption vulnerability in Google Chrome ServiceWorker. The CVE record was published on 2026-10-20T21:02:02.505Z and has not been modified since then. The vulnerability has been assessed as Medium severity by Chromium. There are no known instances of exploitation in the wild, but defenders should remain vigilant. Evidence is limited to official sources and CVE details, and defenders should verify Chrome version and assess exposure to crafted HTML

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.