PatchSiren cyber security CVE debrief

CVE-2026-113233 Google CVE debrief

CVE-2026-113233 debrief based on CVE Program and NVD records. Google Chrome on Android prior to 156.0.8078.47 had an out-of-bounds read vulnerability in Core. This CVE was published on 2026-10-20T21:02:32.117Z and has not been modified since then. The NVD entry is currently unclassified. The vulnerability could potentially allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page, which defenders should verify and update to prevent potential code execution.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-21
Advisory published: 2026-10-20
Advisory updated: 2026-10-21

Who should care

Defenders responsible for managing Google Chrome on Android deployments should assess exposure and prioritize updating to the latest version. This includes verifying Chrome versions, reviewing Chromium security advisories, and monitoring Chrome releases for future security updates.

Why it matters

CVE-2026-113233 is an out-of-bounds read vulnerability in Google Chrome on Android prior to 156.0.8078.47. Defenders should verify Chrome versions and update to prevent potential code execution.

Verify Chrome version and update to 156.0.8078.47 or later to prevent potential code execution
Monitor Chrome releases for future security updates
Review Chromium security advisories for additional information

Technical summary

The CVE-2026-113233 vulnerability is an out-of-bounds read issue in the Core component of Google Chrome on Android versions prior to 156.0.8078.47. This vulnerability could potentially allow a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The Chromium security team has assessed this issue as Medium severity. Defenders should prioritize verifying Android Chrome versions and updating to 156.0.8078.47 or later to prevent potential code execution within the sandbox via a crafted HTML page.

Defensive priority

Defenders should prioritize verifying Android Chrome versions and updating to 156.0.8078.47 or later.

Recommended defensive actions

Verify Android Chrome versions and update to 156.0.8078.47 or later
Monitor Chrome releases for future updates
Review Chromium security advisories for additional information
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program and NVD records indicate an out-of-bounds read vulnerability in Google Chrome on Android prior to 156.0.8078.47. Chromium security severity is Medium. Defenders should verify Chrome versions and update to 156.0.8078.47 or later to prevent potential code execution. Evidence is limited to CVE Program and NVD records, and defenders should review Chromium security advisories for additional information.

Sources and references

Verified primary and authoritative sources

CVE-2026-113233 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113233

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113233 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113233

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113233
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113233.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/562111801

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.