CVE-2026-113219 Google CVE debrief

Who should care

Defenders responsible for Google Chrome deployments should assess exposure and verify Chrome versions to ensure they are not vulnerable to CVE-2026-113219. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal 35

Why it matters

CVE-2026-113219 is a medium-severity vulnerability in Google Chrome's Contacts feature that allows remote attackers to execute arbitrary code inside the sandbox. Defenders responsible for Chrome deployments should assess exposure, verify Chrome versions, and update to the latest version if necessary.

• Remote attackers may execute arbitrary code inside the sandbox
• Successful exploitation requires user interaction via crafted HTML pages
• Defenders must verify Chrome versions to ensure they are not vulnerable

Technical summary

Memory corruption vulnerability in Google Chrome's Contacts feature prior to version 156.0.8078.47 allows remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. This medium-severity vulnerability impacts Google Chrome deployments and requires defenders to assess exposure and verify Chrome versions to ensure they are not vulnerable to CVE-2026-113219. The vulnerability was patched in Chrome version 156.0.8078.47. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure of Google Chrome installations to CVE-2026-113219
• Verify Chrome version is 156.0.8078.47 or later
• Update Chrome to the latest version if necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program record and NIST NVD detail page confirm memory corruption vulnerability in Google Chrome prior to 156.0.8078.47. Chromium security severity is Medium. The CVE record was published on 2026-10-20T21:02:08.318Z and has not been modified since then. Defenders should verify Chrome versions to ensure they are not vulnerable. The vulnerability allows remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.