PatchSiren cyber security CVE debrief

CVE-2026-113217 Google CVE debrief

CVE-2026-113217 debrief based on CVE Program and NVD records. Google Chrome on Android prior to 156.0.8078.47 is vulnerable to a use-after-free issue in WebAppInstalls, allowing remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. This issue has a high severity and impacts Android users of Google Chrome and cybersecurity teams responsible for browser security. The vulnerability allows remote attackers to execute arbitrary code within the sandbox via crafted HTML pages, emphasizing the need for timely browser updates and monitoring for suspicious activity.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Android users of Google Chrome, cybersecurity teams responsible for browser security, IT administrators managing Chrome deployments, and operators managing Android devices with Chrome installed should prioritize upgrading Chrome to version 156.0.8078.47 or later and monitor for suspicious activity. This vulnerability impacts those responsible for maintaining browser security and ensuring the integrity of Android devices using Google Chrome.

Why it matters

CVE-2026-113217 is a high-severity use-after-free vulnerability in Google Chrome's WebAppInstalls on Android. It allows remote attackers to execute arbitrary code within the sandbox via crafted HTML pages. Android users and cybersecurity teams should prioritize upgrading Chrome to version 156.0.8078.47 or later and monitor for suspicious activity.

Remote code execution within the sandbox
Potential for crafted HTML page attacks
Necessity for timely browser updates
Importance of monitoring for suspicious activity

Technical summary

The CVE-2026-113217 vulnerability is a use-after-free issue in WebAppInstalls of Google Chrome on Android prior to version 156.0.8078.47. This allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The issue has a high severity and impacts Android users and cybersecurity teams. It is essential to upgrade Chrome to version 156.0.8078.47 or later and implement necessary mitigations to prevent potential attacks. The vulnerability highlights the importance of timely browser updates and monitoring for suspicious activity.

Defensive priority

High

Recommended defensive actions

Upgrade Google Chrome on Android to version 156.0.8078.47 or later
Implement sandboxing and code execution mitigations
Monitor for suspicious HTML page activity
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records confirm a use-after-free vulnerability in Google Chrome's WebAppInstalls on Android before version 156.0.8078.47. This issue allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

CVE-2026-113217 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113217

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113217 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113217

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113217
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113217.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/568900845

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.