CVE-2026-113220 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome on Android deployments should assess exposure and prioritize updates to version 156.0.8078.47 or later. This includes IT teams managing Chrome installations, security teams monitoring for suspicious activity, and operators responsible for maintaining Android systems with Chrome deployed. These stakeholders must verify Chrome versions, assess user exposure, and implement necessary mitigations to prevent or -

Why it matters

CVE-2026-113220 is a memory corruption vulnerability in Google Chrome Extensions on Android that could allow remote attackers to potentially execute arbitrary code inside the sandbox. Defenders should prioritize verifying and updating Chrome to version 156.0.8078.47 or later, assess exposure for users on vulnerable versions, and monitor for suspicious activity. The Chromium security severity is rated as Medium.

• Potential arbitrary code execution inside the sandbox requires verification and mitigation
• Exposure assessment and Chrome version updates are necessary for high-risk deployments
• Monitoring for suspicious activity is recommended for Chrome on Android

Technical summary

The memory corruption vulnerability in Google Chrome Extensions on Android prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the sandbox via crafted HTML pages. Rated as Medium by Chromium, this vulnerability impacts Android deployments of Google Chrome, requiring updates to version 156.0.8078.47 or later. Technical details are limited to CVE and source item information, emphasizing the need for defenders to focus on Chrome version verification, exposure assessment, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and updating Google Chrome on Android to version 156.0.8078.47 or later, and assess exposure for users accessing Chrome on potentially vulnerable versions.

Recommended defensive actions

• Verify and update Google Chrome on Android to version 156.0.8078.47 or later
• Assess exposure for users accessing Chrome on potentially vulnerable versions
• Monitor Chrome on Android for suspicious activity
• Implement compensating controls for high-risk deployments
• Review and track exceptions for Chrome on Android deployments
• Conduct regular security audits for Chrome Extensions
• Enhance incident response plans for potential sandbox escapes

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome Extensions on Android, rated as Medium by Chromium. Evidence is limited to CVE and source item details. Defenders should verify Chrome versions, assess exposure for users on vulnerable versions, and monitor for suspicious activity. The CVE was published on 2026-10-20T21:02:06.748Z and has not been modified. No additional sources were consulted due to limited information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.