PatchSiren cyber security CVE debrief

CVE-2026-113241 Google CVE debrief

CVE-2026-113241 debrief based on CVE Program and NVD records. Google Chrome on Android prior to 156.0.8078.47 had a memory corruption vulnerability in Toolbar, potentially allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was publicly disclosed and is considered low severity by Chromium. Defenders should review Chrome version and update to 156.0.8078.47 or later. This vulnerability affects Android deployments of Google Chrome.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for managing Google Chrome on Android deployments should assess exposure and prioritize updates. This includes IT teams managing Chrome deployments, security teams monitoring for potential threats, and operators responsible for maintaining Chrome installations. Defenders should review Chrome version and update to 156.0.8078.47 or later. Vulnerability management and security teams should track this vulnerability and verify Chrome 156.0

Why it matters

CVE-2026-113241 is a memory corruption vulnerability in Google Chrome on Android that could allow a remote attacker to execute arbitrary code inside the sandbox. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later.

Potential execution of arbitrary code inside the sandbox
Verification of Chrome version and updates required

Technical summary

Memory corruption in Toolbar in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was publicly disclosed and is considered low severity by Chromium. Technical impact is limited to potential execution of arbitrary code inside the sandbox. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later. No additional technical details are available. This vulnerability affects Android deployments of Google Chrome.

Defensive priority

Defenders should prioritize verifying Android Chrome versions and updating to 156.0.8078.47 or later.

Recommended defensive actions

Verify Android Chrome versions and update to 156.0.8078.47 or later
Monitor for crafted HTML pages
Implement sandboxing
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records provide details on the memory corruption vulnerability in Google Chrome on Android. The vulnerability was publicly disclosed and is considered low severity by Chromium. Evidence is limited to CVE Program and NVD records. Defenders should verify Chrome versions and update to 156.0.8078.47 or later. No additional evidence is available.

Sources and references

Verified primary and authoritative sources

CVE-2026-113241 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113241

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113241 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113241

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113241
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113241.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/514078082

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.