PatchSiren cyber security CVE debrief

CVE-2026-113238 Google CVE debrief

CVE-2026-113238 debrief based on CVE Program and NVD records. Google Chrome CustomTabs memory corruption vulnerability prior to version 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the sandbox via crafted HTML pages. Defenders should assess exposure, prioritize remediation, and verify sandbox effectiveness. This vulnerability affects Google Chrome deployments on Android, particularly those utilizing CustomTabs, and may lead to potential arbitrary code execution inside the sandbox.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for Google Chrome deployments on Android, particularly those using CustomTabs, should assess exposure and prioritize remediation to prevent potential arbitrary code execution inside the sandbox. This includes reviewing compensating controls, monitoring for potential attacks, and verifying sandbox effectiveness. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential impact on the

Why it matters

CVE-2026-113238 is a memory corruption vulnerability in Google Chrome CustomTabs on Android. Defenders should assess exposure, prioritize remediation, and verify sandbox effectiveness to prevent potential arbitrary code execution.

Potential arbitrary code execution inside the sandbox
Exposure of Google Chrome CustomTabs in Android deployments
Remediation priority for affected versions
Verification of sandbox effectiveness

Technical summary

Memory corruption in CustomTabs in Google Chrome on Android prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the sandbox via crafted HTML pages. The vulnerability is caused by a memory corruption issue in the CustomTabs component of Google Chrome on Android. This issue can be exploited by remote attackers to potentially execute arbitrary code inside the sandbox. Affected versions require verification and remediation to prevent potential arbitrary code execution inside the sandbox.

Defensive priority

Medium

Recommended defensive actions

Assess exposure of Google Chrome CustomTabs in Android deployments
Prioritize remediation of affected versions
Verify sandbox effectiveness
Monitor for potential arbitrary code execution attempts
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program and NVD records confirm memory corruption in Google Chrome CustomTabs. The vulnerability allows potential arbitrary code execution inside the sandbox. Affected versions require verification.

Sources and references

Verified primary and authoritative sources

CVE-2026-113238 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113238

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113238 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113238

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113238
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113238.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/513789297

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.