CVE-2026-113240 Google CVE debrief

Who should care

Google Chrome users, particularly those with Chromecast functionality enabled, should assess exposure and verify their Chrome version. Chrome users should review and implement secure coding practices to prevent similar vulnerabilities. Security teams should monitor for suspicious activity and potential exploitation attempts. IT teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Asset owners

Why it matters

CVE-2026-113240 is a use-after-free vulnerability in Google Chrome's Chromecast functionality, allowing potential execution of arbitrary code inside the sandbox. Chrome users should verify their version and update to 156.0.8078.47 or later.

• Potential execution of arbitrary code inside the sandbox
• Possible exploitation attempts via crafted HTML pages
• Verification of Chrome version and updates required
• Implementation of secure coding practices to prevent similar vulnerabilities

Technical summary

A use-after-free vulnerability in Chromecast in Google Chrome prior to version 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability has a medium severity and is related to the Chromecast functionality in Google Chrome. Chrome users should verify their version and update to 156.0.8078.47 or later to mitigate the vulnerability. The vulnerability is caused by a use-after-free issue in the Chromecast functionality of Google Chrome. Users should review and implement secure coding practices to prevent similar vulnerabilities.

Defensive priority

Medium priority for Chrome users to verify and update to version 156.0.8078.47 or later.

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Review and implement secure coding practices to prevent use-after-free vulnerabilities
• Monitor for suspicious activity and potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the use-after-free vulnerability in Google Chrome prior to version 156.0.8078.47. The vulnerability is caused by a use-after-free issue in the Chromecast functionality of Google Chrome. The CVE Program and NVD records provide information on the affected versions and the potential impact of the vulnerability. Chrome users should verify their version and update to 156.0.8078.47 or later to mitigate the vulnerability. The vulnerability has a medium severity and is related to the Chromecast

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.