PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113247 Google CVE debrief

A memory corruption vulnerability in Google Chrome's DevTools, prior to version 156.0.8078.47, allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This issue, tracked as CVE-2026-113247, was publicly disclosed on October 20, 2026. The vulnerability affects Google Chrome users who may be exposed to crafted HTML pages, and defenders should assess exposure and prioritize patching or mitigating this vulnerability. The CVE record and source item provide details on the vulnerability, including its existence in Chrome prior to version 156.0.8078.47 and the potential for arbitrary code execution within the sandbox.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for managing Google Chrome deployments, especially in environments where users may access untrusted HTML pages, should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-113247 is a memory corruption vulnerability in Google Chrome's DevTools that allows remote attackers to execute arbitrary code within the sandbox. Defenders should prioritize patching or mitigating this vulnerability, especially for Chrome users who may be exposed to crafted HTML pages.

  • Potential for remote code execution within the sandbox
  • Exposure of Chrome users to crafted HTML pages
  • Need for patching or upgrading Chrome to version 156.0.8078.47 or later
  • Importance of monitoring Chrome users for suspicious activity

Technical summary

The CVE-2026-113247 vulnerability is caused by a memory corruption issue in Google Chrome's DevTools. This issue allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability affects Google Chrome prior to version 156.0.8078.47. Defenders should prioritize patching or mitigating this vulnerability, especially for Chrome users who may be exposed to crafted HTML pages. The CVE record and source item provide details on the vulnerability, including its existence in Chrome prior to version 156.0.8078.47 and the potential for arbitrary code execution within the sandbox.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for Chrome users who may be exposed to crafted HTML pages.

Recommended defensive actions

  • Patch or upgrade Google Chrome to version 156.0.8078.47 or later
  • Implement sandboxing and isolation for Chrome users
  • Monitor Chrome users for suspicious activity
  • Restrict access to untrusted HTML pages
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Chrome prior to version 156.0.8078.47 and the potential for arbitrary code execution within the sandbox.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113247 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113247

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113247 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113247

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113247

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113247.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/514508203

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.