CVE-2026-113239 Google CVE debrief

Who should care

Defenders and administrators of Google Chrome for Android deployments should assess exposure and prioritize remediation. This includes reviewing the official advisory, verifying affected scope, and ensuring version 156.0.8078.47 or later is deployed. Security teams and vulnerability management teams should also review this information to prioritize remediation efforts.

Why it matters

CVE-2026-113239 is a Medium severity vulnerability in Google Chrome's SiteIsolation on Android, allowing remote code execution inside the sandbox. Defenders should assess exposure, prioritize remediation, and verify version 156.0.8078.47 or later is deployed.

• Remote code execution inside the sandbox requires verification
• Medium severity vulnerability needs prioritized remediation
• Affected versions require inventory checks and updates

Technical summary

A range error in SiteIsolation in Google Chrome on Android prior to 156.0.8078.47 allows remote attackers to execute arbitrary code inside the sandbox via crafted HTML pages. This Medium severity vulnerability requires defenders to assess exposure and prioritize remediation efforts. The vulnerability affects Google Chrome for Android deployments, and users should verify version 156.0.8078.47 or later is deployed. Official CVE Program and NVD records confirm this vulnerability, and defenders should review these sources for further information.

Defensive priority

Medium

Recommended defensive actions

• Assess exposure of Google Chrome for Android versions prior to 156.0.8078.47
• Prioritize remediation for affected systems
• Verify version 156.0.8078.47 or later is deployed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program and NVD records confirm a range error in Google Chrome's SiteIsolation on Android prior to 156.0.8078.47. Chromium security severity is Medium. Evidence is limited to CVE Program and NVD records, and defenders should verify this information with official sources. The CVE record was published on 2026-10-20T21:02:05.041Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.