CVE-2026-113236 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome installations on iOS devices should assess exposure and prioritize patching to version 156.0.8078.47 or higher. This includes reviewing inventory of Google Chrome installations, monitoring security advisories for future updates, and verifying patch application. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary actions to mitigate the risk.

Why it matters

CVE-2026-113236 is a high-severity use-after-free vulnerability in Google Chrome's Navigation component on iOS, allowing remote code execution inside the sandbox. Defenders should prioritize patching to version 156.0.8078.47 or higher.

• Potential remote code execution inside the sandbox, requiring immediate patching.
• Need for inventory checks and updates of Google Chrome on iOS devices.
• Monitoring of Google Chrome security advisories for future vulnerabilities.

Technical summary

A use-after-free vulnerability exists in the Navigation component of Google Chrome on iOS prior to version 156.0.8078.47. This allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is classified as high-severity, emphasizing the need for immediate patching to version 156.0.8078.47 or higher. Defenders should prioritize verifying and applying the patch, reviewing inventory, and monitoring security advisories for future updates related to Google Chrome on iOS.

Defensive priority

Defenders should prioritize verifying and applying the patch for Google Chrome on iOS to versions 156.0.8078.47 or higher, focusing on high-severity updates.

Recommended defensive actions

• Verify and apply the patch for Google Chrome on iOS to version 156.0.8078.47 or higher.
• Review and update inventory of Google Chrome installations on iOS devices.
• Monitor Google Chrome release notes and security advisories for future updates.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high severity and the need for an update to version 156.0.8078.47 or higher for Google Chrome on iOS. The vulnerability is a use-after-free issue in the Navigation component, allowing remote code execution inside the sandbox. Evidence is limited to CVE Program and NVD records, with no additional information available. Defenders should verify patch application and review inventory of Google Chrome installations on iOS devices.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.